ATLANTA, July 23 (Nationwide Times) — Chick-fil-A says a security incident may have exposed personal information linked to a limited number of Chick-fil-A One loyalty accounts, including customers in several U.S. states and Washington, D.C.
What Chick-fil-A said happened
The company said unauthorized parties targeted its website and mobile app between June 17 and June 19. Chick-fil-A said the attackers used account credentials obtained from a third-party source. The company said it later spotted suspicious login activity involving certain Chick-fil-A One accounts.
Chick-fil-A said it moved quickly to secure affected accounts and notify customers who may have been impacted. In a later update, the company said fewer than 2% of Chick-fil-A One loyalty program participants were affected.
What information may have been exposed
In the later incident, Chick-fil-A said the information that may have been compromised included names, email addresses, Chick-fil-A One membership and mobile payment numbers, the last four digits of payment cards, and the amount of Chick-fil-A credit stored in accounts.
A separate Chick-fil-A notice filed with Massachusetts describes an earlier incident that involved suspicious login activity between Dec. 18, 2022, and Feb. 12, 2023. That notice said the information in affected accounts may have included a name, email address, membership number, mobile pay number, QR code, masked debit or credit card number, and Chick-fil-A credit balance. It also said saved birthday month and day, phone number, and address may have been included.
The Massachusetts notice said unauthorized parties could only view the last four digits of a payment card number.
Where customers were affected
Chick-fil-A said the incident affected customers in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont, and Washington, D.C.
Massachusetts is a notable part of the public record because Chick-fil-A filed a customer notice with the state’s breach-notice system.
What Chick-fil-A says it did
Chick-fil-A said it reset passwords for affected accounts, restored impacted loyalty balances, and added rewards to customer accounts. In the earlier Massachusetts notice, the company also said it removed stored credit and debit card payment methods, temporarily froze funds loaded onto Chick-fil-A One accounts, restored account balances, and added rewards.
What is still unclear
The public notices describe at least two time windows of suspicious activity, one in late 2022 and early 2023 and another in June. The available records do not make clear whether those notices describe separate incidents or the same broader problem.
The notices also do not identify a suspect, announce criminal charges, or say whether any personal information was actually misused. They say the information may have been exposed.
For customers, the key point is that Chick-fil-A says the issue was limited, but the notices show that account details and some payment-related information were involved.
