2-Day Credential Stuffing Attack Exposes Chick-fil-A Loyalty Data

For retail and e‑commerce leaders, loyalty programs are goldmines of customer data—and now prime targets. When a fast‑food giant like Chick‑fil‑A suffers a credential stuffing breach that exposes mobile pay numbers and stored value, the industry must reassess its digital defenses.

Chick-fil-A has disclosed a data breach that impacted an undisclosed number of Chick-fil-A One loyalty accounts, the result of an automated credential stuffing attack between July 17 and 19, 2026. Using email and password combinations obtained from a third‑party source, attackers gained access to personal and financial information stored in customer profiles. Exposed data included names, email addresses, loyalty membership numbers, mobile pay numbers, QR codes, the last four digits of stored payment cards, and any Chick‑fil‑A credit on the account. In some cases, birthdays, phone numbers, and saved addresses were also compromised. No full credit card numbers, Social Security numbers, or account passwords were exposed, limiting the immediate fraud risk, but the breadth of PII and partial payment details still poses phishing and account takeover threats.

“

Chick-fil-A has disclosed a data breach that impacted an undisclosed number of Chick-fil-A One loyalty accounts, the result of an automated credential stuffing attack between July 17 and 19, 2026.

The fast‑food chain moved quickly after detecting the unauthorized logins on its website and mobile app. Beginning July 20, 2026, letters were sent to affected customers, and the company filed notice with the Massachusetts Attorney General’s Office. Chick‑fil‑A forced log‑outs on compromised accounts, removed stored payment methods, restored any drained loyalty balances, and added bonus rewards as a goodwill gesture. It also urged users to reset passwords, adopt unique credentials, and monitor financial accounts and credit reports for abnormal activity.

This incident is the latest in a growing wave of credential stuffing attacks targeting retail and hospitality loyalty programs. Because these programs often hold not only PII but also stored value and partial payment tokens, they have become attractive targets for cybercriminals. The attack vector is straightforward: hackers obtain large databases of breached credentials from underground forums, then use automated scripts to attempt logins across high‑value consumer platforms. Even a low match rate can yield thousands of compromised accounts, particularly when users reuse passwords. For Chick‑fil‑A, the breach exposes a tension between frictionless, app‑driven convenience and security. Loyalty programs that store mobile pay numbers and QR codes for quick checkout create an attack surface that demands more robust defenses.

The company’s response aligns with best practices—transparent notification, forced resets, removal of sensitive payment info, and promotion of password hygiene. Yet it also underscores the industry’s persistent reliance on single‑factor authentication for loyalty logins. Without mandatory multi‑factor authentication (MFA), customers who reuse passwords remain vulnerable. Many retail loyalty programs have hesitated to require MFA, fearing it would add friction and reduce engagement. This breach may accelerate calls for stronger authentication standards and could prompt regulators to scrutinize the security of customer loyalty data more aggressively.