If your Chick-fil-A One account was caught in the June 2026 credential stuffing attack, do four things today: change your Chick-fil-A password to a unique passphrase you use nowhere else, change that same password everywhere else you reused it, turn on two-factor authentication, and check your saved payment methods and rewards balance for anything you did not authorize.
This Was Not a Breach of Chick-fil-A's Systems
Chick-fil-A was not hacked. Attackers took email-and-password pairs stolen from unrelated third-party breaches and replayed them against the Chick-fil-A One website and app. The accounts that fell were the ones where customers had reused a password that had already leaked somewhere else. That distinction matters, because it means the same password is almost certainly opening other doors of yours right now.
What Happened
Between June 17 and June 19, 2026, unauthorized parties ran an automated credential stuffing attack against the Chick-fil-A website and mobile app. Chick-fil-A's security team verified the compromise on July 13, 2026 and began sending notification letters dated July 20, 2026.
In filings with state attorneys general, Chick-fil-A reported the incident affected 13,322 people nationwide, including 2,182 residents of Texas and 39 residents of Massachusetts. This is the second credential stuffing incident to hit the Chick-fil-A One loyalty program, following an earlier campaign against the same app.
What Information Was Exposed
Because attackers logged in as the account holder, they saw whatever the account itself displayed. According to the notification letter, that can include:
- Name and email address
- Chick-fil-A One membership number and mobile pay number
- Your account QR code
- The last four digits of a saved credit or debit card
- The amount of Chick-fil-A credit on the account
- Where saved to the account: month and day of birth, phone number, and street address
Full card numbers were not exposed. But the combination that was exposed — name, email, phone, address, partial card, and birth month and day — is precisely the package a social engineer needs to pass a phone verification with a bank or a mobile carrier. Treat it as identity data, not as loyalty-app trivia.
How Chick-fil-A Responded
Chick-fil-A logged out every affected account, stripped saved payment methods from them, restored account balances that had been drained, notified affected customers, and issued a goodwill reward. Those steps close the immediate hole in the loyalty account. They do nothing about the reused password itself, which is the part only you can fix.
Step 1: Change Your Chick-fil-A Password — Then Change It Everywhere Else
Open the Chick-fil-A One app or chick-fil-a.com and set a new password that is long, random, and used on no other site. A passphrase of four or five unrelated words is both stronger and easier to type on a phone than a short string of symbols.
Then do the harder and more important part. Credential stuffing works because the same email-and-password pair unlocks many accounts. If the password that opened your Chick-fil-A account is also your password for email, banking, Amazon, or a streaming service, change it on every one of those accounts too. Start with your primary email account: whoever controls that inbox can reset the password on everything else you own.
Step 2: Turn On Two-Factor Authentication
Two-factor authentication is the single control that defeats credential stuffing outright. Even with a valid password, an attacker cannot get in without the second factor. Enable it on your email, your bank, and every account that offers it. Prefer an authenticator app such as Aegis, Authy, or the code generator built into your password manager over SMS codes, which can be intercepted through a SIM swap.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 3: Check Your Money and Your Rewards
- Review your Chick-fil-A One order history and rewards balance for redemptions you did not make. Chick-fil-A restored drained balances, but verify yours yourself.
- Scan the last three months of bank and credit card statements for small unfamiliar charges. Fraudsters test a card with a tiny purchase before attempting anything larger.
- Re-add your payment method only after you have set the new password and enabled two-factor authentication — not before.
Step 4: Get a Password Manager
You cannot remember a unique password for two hundred accounts, and you should not try. A password manager generates and stores a different random password for every site, which makes credential stuffing structurally impossible against you: a password stolen from one breach unlocks exactly one account. Most reputable managers will also audit your existing vault and flag every password you have reused, which is the fastest way to find the rest of your exposure from this incident.
Step 5: Expect Targeted Phishing
Whenever a breach becomes public, scammers move in with emails and texts that reference it. Expect messages claiming to be from Chick-fil-A offering compensation, a refund, or a “secure your account” link.
How to Tell a Real Notice From a Fake One
Chick-fil-A notified affected customers by letter and email, and it will never ask you for your password, your full card number, or a payment to release a reward. Never act on a link in an unexpected message. Open the Chick-fil-A app yourself, or type chick-fil-a.com into the address bar. If the offer is real, it will be there when you arrive under your own steam.
Step 6: Shrink the Data That Made You a Target
Credential stuffing needs your email address, and the reason attackers have so many working addresses to try is that data brokers and people-search sites publish them alongside your name, phone number, home address, age, and relatives. That aggregated profile is also what turns a partial card number and a birth month into a successful social engineering call.
PrivacyOn removes your personal information from 100+ data broker and people-search sites automatically, then keeps monitoring so it stays gone when brokers re-scrape you. Our 24/7 dark web monitoring also tells you when your email address and passwords show up in a new credential dump — which is how you find out you need to rotate a password before someone stuffs it into a login form. Plans start at $8.33/month and cover up to 5 family members. Run a free PrivacyOn scan to see what is exposed under your name today.
Frequently Asked Questions
Was Chick-fil-A actually hacked?
No. Chick-fil-A's own systems were not breached. Attackers used email addresses and passwords stolen from other companies' breaches and tried them on Chick-fil-A One accounts between June 17 and 19, 2026. Accounts fell only where the customer had reused a password that had already leaked elsewhere.
How many people were affected by the Chick-fil-A data breach?
Chick-fil-A reported 13,322 people affected in filings with state attorneys general, including 2,182 in Texas and 39 in Massachusetts. Notification letters were dated July 20, 2026.
Was my credit card number stolen?
Full card numbers were not exposed. Attackers could see the last four digits of a card saved to the account, along with your Chick-fil-A credit balance. That is not enough to make a purchase directly, but it is enough to make a phishing call sound convincing, so treat any caller who “confirms” your last four digits with suspicion.
Do I need to freeze my credit after this breach?
No Social Security numbers or full card numbers were exposed, so a freeze is not strictly required here. But a credit freeze is free, takes about ten minutes at each of the three bureaus, and blocks new accounts from being opened in your name — and given how much of your data is already circulating from other breaches, it is worth doing regardless of this incident.
How do I know if my password has been leaked in another breach?
Most password managers include a breach-monitoring feature that checks your saved credentials against known dumps. Continuous dark web monitoring, like the kind included with PrivacyOn, goes further by alerting you when your email address or passwords surface in a new credential dump so you can rotate them before an attacker tries them.
Will Chick-fil-A compensate affected customers?
Chick-fil-A restored account balances that were drained and issued a reward to affected customers. Any legitimate compensation will appear in your Chick-fil-A One account or arrive through the official notification letter — never through an unsolicited text or email asking you to click a link or confirm payment details.