Chick-fil-A disclosed a June 2026 credential-stuffing attack that compromised customer accounts across its website and mobile app, exposing names, emails, Chick-fil-A One numbers, mobile pay details, and partial card data, with at least 2,182 Texans affected and notifications also sent to Iowa and other states after an internal July 13 investigation. The breaches underscore ongoing risks from reused credentials and follow earlier credential-stuffing incidents in 2022–23 and 2025–26 involving similar data exposure.
