Chick-fil-A Reports Data Breach Targeting Rewards Accounts

Chick-fil-A disclosed a data breach this week that targeted its Chick-fil-A One rewards program accounts. The company identified suspicious login activity last month and an investigation revealed that hackers launched an automated attack using a list of email logins and passwords obtained from a third party. This credential stuffing attack occurred over three days in mid-June.

The unauthorized users may have accessed sensitive data stored within affected Chick-fil-A One rewards accounts. This data includes customer names, email addresses, phone numbers, birth dates, physical addresses, and the last four digits of credit card numbers. Chick-fil-A stated in a company website announcement that it takes the protection of personal information seriously. Upon discovering the incident, the company immediately took steps to secure customer accounts, including forcing log-outs from affected accounts and removing any stored payment methods. The company also restored the Chick-fil-A One account balances for impacted customers.

The breach highlights the risks associated with credential stuffing, a common hacking technique where attackers use lists of stolen username and password combinations to gain access to multiple online accounts. This method exploits the widespread practice of password reuse across different services. Chick-fil-A's notification letters indicate that customers in several states, including D.C., Maryland, Iowa, Vermont, Massachusetts, New Mexico, New York, North Carolina, and Oregon, may have been affected by this incident.