Chick-fil-A One account credential stuffing
From December 18, 2022 to February 12, 2023, attackers tested credentials stolen in other breaches against Chick-fil-A One loyalty accounts and took over 71,473 of them, exposing names, contact details, partial card numbers and reward balances. Chick-fil-A notified customers in a letter dated March 2, 2023, forced logouts, removed stored payment methods and restored balances.
- Victim
- Chick-fil-A
- Industry
- Retail and e-commerce
- Country
- United States
- Intrusion began
- Dec 18, 2022
- First disclosed
- Mar 2, 2023
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 71,473 (Customers, per Chick-fil-A's filing with the Maine attorney general.)
- Disclosed cost
- Not disclosed
The identity lesson
Loyalty accounts with stored value are a cash-out target. Breached-password checks, bot detection and step-up authentication before redeeming value would have blunted a months-long stuffing run.
Go deeper on SWI
- Technique: Credential stuffing
Sources
- Over 71K impacted by credential stuffing attacks on Chick-fil-A accounts, SecurityWeek, Mar 6, 2023
- Credential stuffing attack at Chick-fil-A comes with data breach notice for customers, Bitdefender, Mar 7, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). Chick-fil-A One account credential stuffing. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-chick-fil-a-credential-stuffing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.