Chick-fil-A data breach exposes personal information from loyalty accounts - AJC.com

What the report says

The Atlanta Journal-Constitution reported that Chick-fil-A disclosed a security incident involving some Chick-fil-A One loyalty accounts, saying an automated attack in June exposed personal information for an undisclosed number of customers. According to the AJC, a company letter to the Massachusetts attorney general said the activity occurred between June 17 and June 19 and involved login credentials obtained from outside sources, not directly from Chick-fil-A.

The information that may have been viewed included names, email addresses, phone numbers, physical addresses, birth month and day, and the final four digits of saved payment cards, the AJC reported. A Chick-fil-A spokesperson told the newspaper the breach affected a “limited number” of loyalty accounts and said the company is contacting potentially affected customers.

Chick-fil-A said it responded by securing and restoring accounts, forcing affected users to log out, removing stored payment methods, resetting passwords, restoring account balances and adding a reward for impacted customers, according to the report. The AJC said public filings listed 39 affected residents in Massachusetts and 2,182 in Texas, while it remained unclear whether Georgia residents were included.

The incident matters because Chick-fil-A One is tied to a major restaurant chain’s customer rewards and payment ecosystem. The College Park-based company is one of the largest fast-food chains in the United States, with more than 3,000 restaurants in the U.S. and Canada, and the AJC noted it previously reported a similar automated account attack in 2023. The newspaper also placed the disclosure in a broader local business context, noting that Coca-Cola recently reported a separate ransomware-related disruption at its Fairlife dairy brand.