Threat actors conducted a credential stuffing attack against Chick-fil-A One accounts by using credentials obtained from third-party breaches or phishing campaigns. The attack targeted the mobile app and website over a three-day period. Compromised accounts potentially exposed names, email addresses, membership numbers, partial payment card numbers, balances, and in some cases phone numbers, addresses, and dates of birth. Chick-fil-A mitigated the incident by forcing logouts, resetting passwords, removing payment methods, and restoring account balances. The attack exploited credential reuse rather than a vulnerability in Chick-fil-A's systems.

The attack resulted in unauthorized access to customer loyalty accounts, exposing personal and partial payment information. Some accounts were drained of balances, causing financial loss to customers. The incident affects customer privacy and trust but does not indicate a direct compromise of Chick-fil-A's internal systems. The scale of impact is estimated in the thousands to tens of thousands of accounts.

Chick-fil-A has already taken remediation actions including forced logouts, password resets, removal of stored payment methods, and restoration of drained balances with additional rewards. Customers should ensure they use unique passwords and enable multi-factor authentication where possible. Organizations should monitor for credential stuffing attempts and encourage customers to avoid password reuse. Patch status is not applicable as this attack exploited credential reuse rather than a software vulnerability.