Chick-fil-a is notifying customers of a data breach after credential stuffing attacks compromised “Chick-fil-a One” accounts via its website and mobile app between June 17th and 19th, 2026. Attackers used stolen usernames and passwords from third-party sources to log in, potentially accessing names, email addresses, membership and mobile pay numbers, QR codes, Chick-fil-a credit balances, and the last four (4) digits of payment cards, plus any stored birth dates, phone numbers, and addresses. The company hasn’t disclosed total affected accounts but reported impacts to residents in multiple US states, including Texas and Massachusetts. In response, Chick-fil-a logged out impacted users, removed stored payment methods, restored account balances, and added rewards, advising customers to change passwords. This follows a similar credential stuffing incident Chick-fil-a disclosed in March 2023 that affected over 71,000 customers.