Chick-fil-A
Disclosed Jul 20, 20262 months ago13,322 affectedConfirmed
Chick-fil-A One loyalty accounts hit by credential stuffing, 13,322 affected
Chick-fil-A notified customers that credential stuffing attacks from June 17 to 19, 2026 compromised Chick-fil-A One accounts, exposing names, emails, membership numbers, account credit, and card last four digits. Its Maine filing lists 13,322 people.
What is known
| People affected | 13,322 (as reported by the organization) |
|---|---|
| Disclosed | Jul 20, 2026 |
| Discovered | Jun 2026 |
| Attack | Credential stuffing |
| Data exposed | Names, Emails, Payment cards, Other, Financial, Addresses |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Chick-fil-A data breach affects more than 13,000 customersbleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0005189: Chick-fil-Aoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: Chick-fil-Aago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Vermont AGresidents of VT | Jul 20 | 2 |
| Texas AGresidents of TX | Jul 21 | 2,182 |
| Researchtotal | Jul 22 | 13,322 |
Other breaches at Chick-fil-A
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Automated credential stuffing attack compromises Chick-fil-A One accountsMar 2, 20233 years agoCredential stuffing | Mar 2, 20233 years ago | Credential stuffing | Retail | Confirmed | Unknown |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · disclosed: 2026-07-21 to 2026-07-20 · backfill source
- 2026-09-25 · source_type: press to official · backfill source
- 2026-09-25 · source_url: https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/ to https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage · backfill source
- 2026-09-25 · status: disclosed to confirmed · backfill source
- 2026-09-25 · verified_by: empty to tx-ag · backfill source
- 2026-09-25 · verified: 0 to 1 · backfill source
- 2026-09-25 · data_types: ["names","emails","payment-card","other"] to ["names","emails","payment-card","other","financial","addresses"] · backfill source
- 2026-09-25 · disclosed: 2026-07-22 to 2026-07-21 · backfill source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Texas AG. Record counts are as reported. Not legal advice.