Chick-fil-A loyalty accounts hijacked using stolen passwords

Chick‑fil‑A detected automated credential stuffing activity against Chick‑fil‑A One accounts from June 17–19, 2026, using credentials obtained from prior breaches or third‑party sources; attackers accessed account details such as names, emails, membership and mobile pay numbers, QR codes, reward balances, and potentially birthdate, phone number, and partial card digits. The company reset affected account passwords, terminated active sessions, and advised customers to set unique passwords, enable MFA, and follow recovery processes; the report also explains how credential stuffing works and offers consumer remediation guidance.