Chick-fil-A customers in 10 states may have been part of data breach, company says - NBC Boston

What the report says

NBC10 Boston reported that Chick-fil-A has notified some loyalty customers in 10 states and Washington, D.C., that their accounts may have been exposed in a June cybersecurity incident. The company said unauthorized parties may have accessed Chick-fil-A One accounts through its website and mobile app between June 17 and June 19, 2026.

According to the notice cited by NBC10 Boston, the information potentially accessed included customers’ names, email addresses, loyalty membership numbers, Chick-fil-A credit, and the last four digits of credit or debit card numbers. The company said it determined on July 13 that account information may have been accessed. Massachusetts posted the company’s letter, which listed affected customers in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Washington, D.C. Texas separately reported that 2,182 residents were affected.

Chick-fil-A said it took several steps after the incident, including resetting passwords for impacted accounts, forcing account logouts, removing stored payment methods and restoring affected Chick-fil-A One balances. The company also said it added rewards to impacted accounts and advised customers to change passwords promptly.

The notice urged customers to watch for signs of fraud or identity theft and to review account statements and credit reports for unfamiliar activity. While the report does not indicate that full payment card numbers were exposed, even partial account and contact details can be useful in phishing attempts or account takeover efforts, making follow-up monitoring important for affected customers.