Chick-fil-A warns cyberattack may have exposed customer data in multiple states
Chick-fil-A has warned that a cyberattack may have exposed personal and account information from a limited number of its Chick-fil-A One loyalty accounts. The incident highlights the risk of reusing passwords across websites, as attackers used credentials obtained from another source to access accounts.
The automated “credential-stuffing” attack targeted the company’s website and app between 17 and 19 June and affected customers in 10 US states and Washington, DC. Potentially exposed information included names, email addresses, loyalty and mobile-payment identifiers, QR codes, the final four digits of payment cards and account credit; some accounts may also have contained addresses, phone numbers and birth-date details. Chick-fil-A logged affected users out, removed stored payment methods, restored balances and advised customers to reset passwords and check account activity.
- Hackers may have accessed Chick-fil-A loyalty-account data.
- Stolen passwords were used in an automated attack.
- Customers in 10 states and Washington, DC were notified.
New here? Start with this
Chick-fil-A, the American fast-food chain, has disclosed that a cyberattack may have compromised customer data from its loyalty rewards programme in June. The breach affected a limited number of accounts belonging to customers in ten US states and Washington, DC.
Attackers used a technique called "credential-stuffing" to access these accounts. This involves using stolen usernames and passwords obtained from breaches at other companies to try to access accounts elsewhere—it works because many people use the same password across multiple websites. The potentially exposed information included names, email addresses, loyalty programme details and payment-card information, along with account balances and QR codes used in-app.
The incident underscores a broader concern about data security in digital commerce. When breaches happen at one company, stolen credentials can be used to compromise accounts at other companies, putting customer information and financial details at risk across multiple services.
Business Companies Cricket Cybersecurity Politics Sport Technology