Skip to content

Chick-fil-A

Disclosed Mar 2, 20233 years agoConfirmed

Official notice

Automated credential stuffing attack compromises Chick-fil-A One accounts

Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membership numbers, mobile pay numbers and stored balances.

What is known

People affectedNot stated in the sources we have
DisclosedMar 2, 2023
DiscoveredFeb 12, 2023
HappenedDec 18, 2022
AttackCredential stuffing
Data exposedNames, Emails, Financial, Other
SectorRetail · US
StatusConfirmed

Sources

Source
California Attorney General breach notice: Chick-fil-Aoag.ca.gov · Official notice
California AG data breach notice: Chick-fil-A, Inc.oag.ca.gov · Regulator

Notices filed

WhereFiledPeople
California AGresidents of CAMar 2, 2023
ResearchtotalMar 2, 2023

Other breaches at Chick-fil-A

BreachAffected
Chick-fil-A One loyalty accounts hit by credential stuffing, 13,322 affectedJul 202 months agoCredential stuffing13K
History of this record
  • 2026-09-25 · sector: other to retail · seed source
  • 2026-09-25 · attack: unknown to credential-stuffing · seed source
  • 2026-09-25 · data_types: [] to ["names","emails","financial","other"] · seed source
  • 2026-09-25 · discovered: empty to 2023-02-12 · seed source
  • 2026-09-25 · summary: empty to Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membership · seed source
  • 2026-09-25 · title: empty to Automated credential stuffing attack compromises Chick-fil-A One accounts · seed source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Chick-fil-A

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.