Chick-fil-A Data Breach Exposes Customer Payment and Rewards Data in 10 States Chick-fil-A has alerted customers in 10 states about a cyberattack that compromised sensitive account details, including stored payment information and rewards balances. The breach, disclosed on July 27, 2026, raises concerns over potential identity theft and financial fraud for affected users. While the fast-food chain has not released specifics on the attack vector or the number of impacted accounts, the incident underscores the growing risks of digital payment systems in retail. Customers in the affected states details of which have not been publicly confirmed may face heightened exposure to fraudulent transactions or credential misuse. The breach follows a pattern of high-profile attacks targeting food service chains, where loyalty programs and stored payment methods present lucrative targets for cybercriminals. Chick-fil-A has not yet indicated whether the attack involved ransomware, credential stuffing, or another method, but investigations are ongoing. As of now, the company has not provided guidance on remediation steps, leaving affected customers to monitor their accounts for suspicious activity. The incident serves as a reminder of the vulnerabilities in third-party payment processing and customer data storage.

Chick-fil-A Confirms Data Breach Exposing Customer Payment Details Chick-fil-A recently disclosed a data breach affecting customers, with exposed information including email addresses, mobile payment numbers, and partial credit card details. The fast-food chain reported the incident to affected individuals and multiple state Attorney General offices after detecting suspicious activity. According to filings, the breach was officially reported on July 20. The Commonwealth of Massachusetts noted that 39 residents were impacted, while a separate filing in Texas indicated 2,182 affected customers though the total nationwide scope remains unclear. The breach was first reported by Bleeping Computer, with additional details sourced from state government disclosures. Chick-fil-A has not yet provided further public updates on the incident or its cause. The investigation is ongoing.

Chick-fil-A Data Breach Exposes Customer Loyalty Account Information Chick-fil-A has notified customers of a data breach affecting its Chick-fil-A One loyalty program after detecting suspicious login activity. The company sent letters to impacted individuals on July 20, 2026, revealing that unauthorized parties accessed accounts between July 17 and July 19 using credentials obtained from a third party. The breach exposed customers’ names, email addresses, membership numbers, and the last four digits of saved payment cards. Additional stored details, such as birthdays and addresses, may have also been compromised. Chick-fil-A stated that only a limited number of accounts were affected and that it took immediate action to secure them, including forced logouts, removal of saved payment methods, and restoration of account balances. In response, the company has urged affected customers to reset their passwords and monitor financial statements for unusual activity. No evidence suggests broader system vulnerabilities, but the incident highlights the risks of credential-based attacks on loyalty programs.

Chick-fil-A Data Breach Exposes Customer Information Chick-fil-A confirmed last week that its website and mobile app were targeted in a cyberattack, potentially compromising some customers’ personal data. The company disclosed the incident but did not specify the number of affected users or the exact nature of the exposed information. While details remain limited, the breach highlights ongoing risks to consumer data in digital platforms. In unrelated incidents, a fire on South Winooski Avenue in Burlington displaced nine people and a cat early Thursday morning. Additionally, a fatal four-vehicle crash occurred on July 1 at the intersection of East John Street and McKee Road. Separately, Jefferson Energy Cooperative announced it will return over $4.5 million in capital credits to its members. Elsewhere, fruit puree pouches sold at major retailers including Target, Kroger, and Meijer were recalled due to a packaging defect and potential contamination with plastic pieces. Authorities also arrested two individuals weeks after a deadly multi-vehicle collision in Mecklenburg County.

Chick-fil-A Hit by Credential Stuffing Attack, Exposing Customer Data Chick-fil-A, the third-largest U.S. quick-service restaurant chain, has notified an undisclosed number of customers about a data breach stemming from a credential stuffing attack. The incident targeted the company’s website and mobile app between June 17 and 19, 2026, with unauthorized parties using stolen login credentials from third-party sources to access accounts. The breach exposed a range of customer data, including names, email addresses, Chick-fil-A One membership numbers, mobile pay details, QR codes, account credit balances, and the last four digits of payment cards. Some accounts also contained birth dates, phone numbers, and addresses, which may have been accessed. Chick-fil-A detected the attack after identifying suspicious login activity and confirmed on July 13, 2026, that unauthorized access had occurred. While the total number of affected customers remains undisclosed, the company reported that 2,182 Texas residents were impacted, with additional notifications sent to individuals in Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island. In response, Chick-fil-A logged out all compromised accounts, removed stored payment methods, restored account balances, and issued rewards as compensation. The company also advised affected users to change their passwords, as the attack leveraged previously leaked credentials. This is not the first such incident for Chick-fil-A in March 2023, the chain confirmed a similar credential stuffing attack between December 2022 and February 2023, which compromised over 71,000 customer accounts and drained stored rewards balances.

Chick-fil-A Loyalty Program Hit by Cyberattack, Customer Data Exposed Chick-fil-A has disclosed a data breach affecting some users of its Chick-fil-A One loyalty program. The fast-food chain revealed that hackers accessed accounts last month using email addresses and passwords obtained from a third-party source, likely through credential-stuffing attacks. Exposed data may include: - Names and email addresses - Membership numbers - The last four digits of some stored payment cards - Gift card balances In response, Chick-fil-A logged out affected users, removed stored payment methods, and advised customers to reset passwords and use unique credentials for their accounts. The incident highlights the risks of reused passwords and third-party data leaks in targeted cyberattacks. The breach was reported in early June 2025, with no indication of how many accounts were compromised. Chick-fil-A has not disclosed further details on the third-party source or the attackers’ motives.

The California Office of the Attorney General reported a data breach involving Chick-fil-A, Inc. on March 2, 2023. The breach occurred between December 18, 2022, and February 12, 2023, involving unauthorized access to Chick-fil-A One accounts, potentially compromising personal information such as names, email addresses, and payment details of an unknown number of individuals.