Story perspectives

Chick-fil-A Alerts Credential-Stuffing Breach, Resets Loyalty Accounts

7/23/2026

Summary

Story summary

Chick-fil-A warned customers in 10 states and Washington, D.C. that a credential-stuffing attack using third-party usernames and passwords from June 17-19, 2026 may have accessed data in loyalty accounts.
On July 13, 2026 the company forced accounts to log out, removed stored payment methods and reset passwords.
Chick-fil-A sent letters on July 20, 2026, added rewards, urged strong unique passwords and said it is enhancing security.

History

Historical Context

In late 2013, Target suffered a supply-chain malware attack that exposed credit-card data of about 40 million shoppers and led to a $162 million FTC fine in 2017. The breach spurred industry-wide adoption of chip-and-pin cards and stricter PCI-DSS rules, prompting retailers to add multi-factor authentication. Chick-fil-A’s June 2026 credential-stuffing incident, which forced password resets for loyalty accounts in ten states, reflects that same shift toward stronger authentication.

1 of 2

Story summary

Chick-fil-A warned customers in 10 states and Washington, D.C. that a credential-stuffing attack using third-party usernames and passwords from June 17-19, 2026 may have accessed data in loyalty accounts.
On July 13, 2026 the company forced accounts to log out, removed stored payment methods and reset passwords.
Chick-fil-A sent letters on July 20, 2026, added rewards, urged strong unique passwords and said it is enhancing security.

1 / 2