Chick-fil-A has confirmed that a recent credential stuffing attack compromised the personal data of over 13,000 customers. The fast-food chain detected suspicious login activity on its website and mobile app, specifically targeting Chick-fil-A One loyalty accounts, between June 17 and June 19.
The company stated in data breach notification letters filed with various attorney general offices that attackers utilized automated tools and credentials acquired from a third-party source to gain unauthorized access to customer accounts. Upon discovery, Chick-fil-A immediately took steps to secure and restore affected accounts and is directly notifying all potentially impacted customers.
The breach affected a total of 13,322 individuals, according to a filing with the Office of the Maine Attorney General. Specific state filings indicate 2,182 Texans and 39 Massachusetts residents were impacted. Notification letters have also been sent to residents in the District of Columbia, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.
Information accessed by the threat actors included customers' names, email addresses, Chick-fil-A One membership numbers, the amount of Chick-fil-A credit, mobile pay numbers, and the last four digits of credit or debit card numbers. Additionally, if stored in the compromised accounts, birth dates, phone numbers, and addresses may also have been exposed.
In response to the incident, Chick-fil-A logged out all affected accounts, removed associated payment methods, and restored all compromised Chick-fil-A One account balances. As an apology, the company also added rewards to the affected accounts.
Given that the account compromises stemmed from credentials stolen from external services, Chick-fil-A has advised all impacted customers to change their passwords promptly.
This incident marks the second time in recent years that Chick-fil-A has disclosed a data breach due to credential stuffing attacks. In March 2023, the company reported that hackers stole personal information from over 71,000 customers through similar attacks conducted between December 2022 and February 2023.
