Chick-fil-A

Disclosed Jul 20, 202613,322 affectedConfirmed

Chick-fil-A One loyalty accounts hit by credential stuffing, 13,322 affected

Chick-fil-A notified customers that credential stuffing attacks from June 17 to 19, 2026 compromised Chick-fil-A One accounts, exposing names, emails, membership numbers, account credit, and card last four digits. Its Maine filing lists 13,322 people.

What is known

People affected	13,322 (as reported by the organization)
Disclosed	Jul 20, 2026
Discovered	Jun 2026
Happened	Jun 17, 2026
Attack	Credential stuffing
Data exposed	NamesEmailsPayment cardsOtherFinancialAddresses
Sector	Retail · US
Status	Confirmed

Sources

Newsbleepingcomputer.com

Chick-fil-A data breach affects more than 13,000 customers

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005189: Chick-fil-A

Official noticeago.vermont.gov

Vermont Attorney General breach report: Chick-fil-A

Official noticein.gov

Indiana Attorney General 2026 data breach report: Chick-fil-A

Notices filed

Residents of VTJul 20

Vermont AG2 people

Residents of INJul 20

Indiana AG320 people

Residents of TXJul 21

Texas AG2,182 people

TotalJul 22

Research13,322 people

Other breaches at Chick-fil-A

Automated credential stuffing attack compromises Chick-fil-A One accountsCredential stuffing exposed names, emails and financial details. Reported to the California AG.Credential stuffingRetailUSMar 2, 2023

History of this record

occurred2026-10-07

empty to 2026-06-17by weeklySource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

disclosed2026-09-25

2026-07-21 to 2026-07-20by backfillSource

source_type2026-09-25

press to officialby backfillSource

source_url2026-09-25

https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/ to https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPageby backfillSource

status2026-09-25

disclosed to confirmedby backfillSource

verified_by2026-09-25

empty to tx-agby backfillSource

verified2026-09-25

0 to 1by backfillSource

data_types2026-09-25

["names","emails","payment-card","other"] to ["names","emails","payment-card","other","financial","addresses"]by backfillSource

disclosed2026-09-25

2026-07-22 to 2026-07-21by backfillSource

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Texas AG. Record counts are as reported. Not legal advice.

Everything about Chick-fil-A