Chick-fil-A has warned customers to update their Chick-fil-A One passwords after detecting unauthorized access to a subset of loyalty accounts during a credential stuffing attack in June 2026.

After conducting an internal investigation, the company confirmed that attackers used an automated credential stuffing attack against its website and mobile app between June 17 and June 19, 2026.

In this type of attack, criminals reuse email and password combinations stolen from previous data breaches, hoping that customers have reused the same credentials on Chick-fil-A One.

The incident affected customers in ten U.S. states, prompting Chick-fil-A to issue formal data breach notifications and security guidance.

The company has reset passwords for the affected accounts, logged users out of active sessions, and removed stored payment methods as a containment measure.

Chick-fil-A Warns Customers After Unauthorized Access

Chick-fil-A is also advising all Chick-fil-A One users to proactively change their passwords, even if they have not yet received an official notification.

According to breach notices and media reports, the potentially exposed data includes customer names, email addresses, mobile payment numbers, and partial payment card details associated with Chick-fil-A One accounts.

Attackers may have also accessed loyalty balances and transaction histories tied to the compromised profiles. While there is no confirmation that full card numbers were stolen, the partial financial data and contact information elevate the risk of downstream fraud and targeted phishing campaigns.

Chick-fil-A has emphasized that the attack used credentials obtained from unrelated third-party breaches, not from a breach of its core authentication database.

This incident marks the second occurrence of credential stuffing activity impacting Chick-fil-A One accounts, following a previous campaign that affected over 70,000 accounts between 2022 and 2023.

The recurrence highlights ongoing vulnerabilities related to password reuse. It underscores the need for stronger account protection on consumer loyalty platforms.

Both security researchers and Chick-fil-A recommend that Chick-fil-A One users immediately create a new, unique password that is not used on any other online service.

Customers who have reused the same password across multiple sites should update their credentials everywhere that combination was used to minimize the risk of further account takeovers.

Users are also encouraged to enable multi-factor authentication (MFA) via a verified mobile phone number, which Chick-fil-A supports for added login protection.

Impacted customers should carefully review their Chick-fil-A account activity, as well as bank and card statements, for any unauthorized purchases or reward redemptions.

Monitoring credit reports and remaining vigilant for phishing emails or SMS messages impersonating Chick-fil-A is also advised, as exposed data can be exploited in social engineering attacks.

This incident serves as a reminder that loyalty apps are attractive targets for attackers due to the stored payment credentials and rich customer profiling data they contain.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment

The post Chick-fil-A Urges Customers to Change Chick-fil-A One Passwords After Unauthorized Access appeared first on Cyber Security News.