US fast-food chain Chick-fil-A member accounts hit by credential stuffing; personal data and balances exposed

According to The Independent, Chick-fil-A is notifying customers nationwide that unauthorized parties may have accessed personal and account information after an automated attack on its website and app in June; according to TechRadar, credential stuffing between June 17 and 19 breached thousands of accounts ^[1][2]. Exposed data may include names, emails, home addresses, phone numbers, birth dates, membership and mobile pay numbers, QR codes, balances and last four card digits, with attackers using passwords from a separate breach; state filings show 2,182 Texas and 39 Massachusetts residents affected ^[1]. Chick-fil-A forced log-outs, reset passwords and removed saved payment methods, and advised customers to create unique passwords not shared with other online services ^[1].

Industries mainly affected: Hospitality & food service

1. Use a unique password for your Chick-fil-A account that you do not share with other services ^[1].