One Password Mistake Helped Hackers Access Chick-fil-A Account

Chick-fil-A disclosed that an automated credential-stuffing campaign from June 17–19 used credentials obtained from a third-party source to access a limited number of customer accounts across 10 U.S. states, exposing names, emails, Chick-fil-A One membership numbers, mobile pay numbers/QR codes, partial card numbers, gift card balances, and other customer-supplied details; the company invalidated sessions, restored affected loyalty balances, notified impacted customers beginning July 20, and recommended password changes and stronger authentication (MFA/passkeys).