Chick-fil-A
Disclosed Mar 2, 20233 years agoConfirmed
Automated credential stuffing attack compromises Chick-fil-A One accounts
Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membership numbers, mobile pay numbers and stored balances.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Mar 2, 2023 |
| Discovered | Feb 12, 2023 |
| Happened | Dec 18, 2022 |
| Attack | Credential stuffing |
| Data exposed | Names, Emails, Financial, Other |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Chick-fil-Aoag.ca.gov · Official notice | Official notice |
| California AG data breach notice: Chick-fil-A, Inc.oag.ca.gov · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Mar 2, 2023 | |
| Researchtotal | Mar 2, 2023 |
Other breaches at Chick-fil-A
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Chick-fil-A One loyalty accounts hit by credential stuffing, 13,322 affectedJul 202 months agoCredential stuffing | Jul 202 months ago | Credential stuffing | Retail | Confirmed | 13K |
History of this record
- 2026-09-25 · sector: other to retail · seed source
- 2026-09-25 · attack: unknown to credential-stuffing · seed source
- 2026-09-25 · data_types: [] to ["names","emails","financial","other"] · seed source
- 2026-09-25 · discovered: empty to 2023-02-12 · seed source
- 2026-09-25 · summary: empty to Chick-fil-A said attackers used login credentials obtained from a third-party source in an automated attack on its website and app from December 2022 to February 2023. Accessed Chick-fil-A One accounts could reveal names, emails, membership · seed source
- 2026-09-25 · title: empty to Automated credential stuffing attack compromises Chick-fil-A One accounts · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.