Chick-fil-A One loyalty accounts taken over by credential stuffing
Chick-fil-A said automated attacks between June 17 and June 19, 2026 used credentials obtained from a third-party source to log in to Chick-fil-A One loyalty accounts on its website and app. Exposed data included names, emails, membership numbers, stored credit balances, mobile pay numbers and the last four digits of payment cards. It is the company's second credential stuffing incident after one disclosed in March 2023.
- Victim
- Chick-fil-A
- Industry
- Retail and e-commerce
- Country
- United States
- Intrusion began
- Jun 17, 2026
- First disclosed
- Jul 24, 2026
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 13,322 (Customers, per Chick-fil-A's filing with the Maine Attorney General.)
- Disclosed cost
- Not disclosed
The identity lesson
Accounts holding stored value accepted reused passwords from other breaches. Bot detection, breached-password checks and passkeys or MFA on accounts with payment methods are the controls.
Go deeper on SWI
- Technique: Credential stuffing
- SWI coverage: chick fil a credential stuffing breach hits 13000 loyalty accounts
Sources
- Chick-fil-A data breach affects more than 13,000 customers, BleepingComputer, Jul 24, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One account credential stuffing 2023 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). Chick-fil-A One loyalty accounts taken over by credential stuffing. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-chick-fil-a-credential-stuffing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.