Chick-fil-A chick-fil-a.com Chick-fil-A data breach: what happened and what to do
Between December 18, 2022 and February 12, 2023, attackers logged into 71,473 Chick-fil-A accounts using passwords stolen elsewhere. They could see names, emails, membership numbers, masked card details and, for some people, birth dates, phone numbers and addresses.
View all 13,115 breaches- Breach date
- 18 Dec 2022
- Made public
- 2 Mar 2023
- Affected
- 71,473
- Data exposed
- Names, Email addresses, Dates of birth, Phone numbers, Physical addresses, Credit cards
- Last updated
Chick-fil-A's 2022 to 2023 incident didn't involve a break-in at the company. Attackers took email and password pairs that had leaked from other sites and tried them on Chick-fil-A's website and app, over and over, until some worked. This is called credential stuffing.
What happened
According to the company's customer letter, dated March 2, 2023, the automated login attempts ran from December 18, 2022 to February 12, 2023. Chick-fil-A's investigation concluded the credentials came from a third-party source, not from Chick-fil-A. The Maine regulator's listing counts 71,473 affected people.
Chick-fil-A responded by forcing password resets, removing stored payment methods from affected accounts and freezing loaded funds. It later restored balances in the accounts that were affected. Press reports said stolen accounts were being sold cheaply before the notices went out.
What was exposed
An attacker who logged in could see what the account page shows. According to the notice, that includes:
- Names and email addresses
- Chick-fil-A One membership numbers and mobile pay numbers
- QR codes used to pay in restaurants
- Masked card details and account credit balances
- For some people: dates of birth, phone numbers, physical addresses and the last four digits of cards
What that lets criminals do
The most direct harm was to the balance. Attackers could use stored value, QR codes and linked payment methods, which is why Chick-fil-A froze funds and restored balances. The personal details are a smaller risk, but dates of birth and addresses help with phishing and with guessing answers to security questions at other companies. A restaurant loyalty account looks harmless, which is exactly why people protect it with their weakest, most reused password. Attackers know that and test those lists against food, retail and travel brands first.
Who is at risk
People who had a Chick-fil-A One account during the attack window, which ran for almost two months, and who reused a password that had already leaked elsewhere. If you got the March 2023 letter, you were one of the 71,473. The letters were sent by the company directly, so an unexpected text or call about it is not the same thing.
The bigger point
This is the same attack as most "account takeover" stories. Nobody hacked the restaurant. Someone reused a password, and a list leaked from a different site did the rest. If you use the same password in more than one place, every one of those accounts is open to this attack.
What to do now
If you got the letter or have a Chick-fil-A One account, change that password and use a unique one. A password manager makes that painless. If you only fix one thing, fix the habit: one password per account. Turn on two-factor authentication anywhere it's offered, and change any other account that shared the same password, starting with your email.
What to do if you were in it
- 1
Change your Chick-fil-A password to a unique one
Don't reuse a password you use anywhere else. A password manager can generate and store one.
- 2
Change the password on any account that shared it
Start with your email, then banking and shopping accounts. Email can reset all the others.
- 3
Turn on two-factor authentication
Use an authenticator app wherever it's offered. It stops a stolen password from working on its own.
- 4
Check your account balance and linked cards
Look at Chick-fil-A One activity and any card you stored. Report unfamiliar charges to your card issuer.
- 5
Expect phishing that mentions your account
Names, emails and phone numbers were visible. Be wary of messages that quote your membership number.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early.
Frequently asked
How many Chick-fil-A customers were affected?
The Maine regulator's listing counts 71,473 people.
Was Chick-fil-A hacked?
Chick-fil-A says attackers used passwords obtained from a third-party source to log in to customer accounts. It describes this as automated credential stuffing, not a break-in to its own systems.
What was exposed?
Names, emails, membership and mobile pay numbers, QR codes, masked card details and balances, plus birth dates, phone numbers, addresses and last four card digits for some customers.
Did I lose money?
Chick-fil-A said it restored balances in accounts affected by the attack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
