Breachesby GlyphChick-fil-A
Disclosed Mar 2, 2023Confirmed
Automated credential stuffing attack compromises Chick-fil-A One accounts
Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membership numbers, mobile pay numbers and stored balances.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Mar 2, 2023 |
| Discovered | Feb 12, 2023 |
| Happened | Dec 18, 2022 |
| Attack | Credential stuffing |
| Data exposed | NamesEmailsFinancialOther |
| Sector | Retail · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Chick-fil-A
History of this record
other to retailby seedSource
unknown to credential-stuffingby seedSource
[] to ["names","emails","financial","other"]by seedSource
empty to 2023-02-12by seedSource
empty to Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membershipby seedSource
empty to Automated credential stuffing attack compromises Chick-fil-A One accountsby seedSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.