Chick-fil-A has disclosed that hackers broke into customer accounts on its Chick-fil-A One loyalty app using a technique called credential stuffing — where attackers take large lists of usernames and passwords stolen from other websites and try them against your account until something works. The company determined on July 13, 2026 that unauthorized parties may have accessed information stored in customer accounts, which can include your name, email address, phone number, payment card details, and points balance.
This kind of attack doesn’t mean Chick-fil-A’s systems were hacked directly. It means your login credentials from a different breach elsewhere were used to access your Chick-fil-A account — and it works because many people reuse the same password across multiple services. If your Chick-fil-A password is one you use anywhere else, your account was potentially at risk.
How to check if you’re affected
Affected products are any Chick-fil-A One accounts that share a password with other websites or services. Here’s what to do right now:
- Log in to your Chick-fil-A One account and check your points balance and recent order history for anything unfamiliar.
- Change your password to something unique to Chick-fil-A that you don’t use anywhere else.
- Check your saved payment methods — remove any cards you don’t want stored there.
- Watch for phishing emails pretending to be Chick-fil-A in the coming weeks.
If you use the same email and password on other food apps, streaming services, or shopping sites, change those passwords too. A password manager makes this much easier.