Chick-fil-A security incident may have exposed some customer account data - Fox Business

What the report says

Fox Business reported that Chick-fil-A disclosed a security incident involving a limited number of Chick-fil-A One loyalty accounts. The Atlanta-based restaurant company said it found suspicious login activity, took action to secure and restore affected accounts, and contacted customers who may have been impacted. A company spokesperson apologized for the concern and said Chick-fil-A remains focused on customer trust.

According to details Fox Business attributed to USA TODAY, the company notified potentially affected customers on Monday after unauthorized parties targeted Chick-fil-A’s website and mobile app between June 17 and June 19. The report said the login attempts used account credentials obtained from a third-party source, a pattern often associated with credential-stuffing attacks, though Fox Business did not use that term in its account.

The information that may have been exposed included names, email addresses, Chick-fil-A One membership and mobile payment numbers, the last four digits of payment cards, and the amount of Chick-fil-A credit in customer accounts. USA TODAY, as cited by Fox Business, reported that affected customers were in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Washington, D.C.

Fox Business said Chick-fil-A reset passwords for affected accounts, restored any impacted loyalty balances and added rewards to customers’ accounts. The incident matters because loyalty programs can store payment-related identifiers and account credits, making restaurant apps a target when reused or stolen passwords from outside sources are tried on consumer accounts.