ATLANTA, July 23 (Nationwide Times) — Chick-fil-A says a security incident may have exposed personal information linked to a limited number of Chick-fil-A One loyalty accounts. In a statement quoted by FOX Business, the company said it moved quickly to secure affected accounts and notify customers who may have been impacted.
What Chick-fil-A said happened
According to the notice described by FOX Business, unauthorized parties targeted Chick-fil-A’s website and mobile app between June 17 and June 19. Chick-fil-A said the attackers used account credentials obtained from a third-party source. The company said it discovered suspicious login activity involving certain Chick-fil-A One accounts and then contacted potentially affected customers.
The company did not identify the third-party source in the notice.
What information may have been exposed
Chick-fil-A said the information may have included names, email addresses, Chick-fil-A One membership numbers, mobile payment numbers, the last four digits of payment cards, and the amount of Chick-fil-A credit stored in accounts.
A separate March 2, 2023 notice filed with Massachusetts described an earlier account issue. In that notice, Chick-fil-A said suspicious login activity took place between Dec. 18, 2022, and Feb. 12, 2023, and that it determined unauthorized parties had accessed information in affected accounts on Feb. 12, 2023.
That notice said the data may also have included a QR code, a masked debit or credit card number, saved birthday month and day, phone number, and address. It also said outsiders could see only the last four digits of a payment card number.
What Chick-fil-A did
In both notices, Chick-fil-A said it reset passwords for affected accounts. The March 2023 notice also said the company removed stored credit and debit card payment methods, temporarily froze funds loaded onto Chick-fil-A One accounts, restored account balances, and added rewards to customer accounts. In the later notice, Chick-fil-A said it restored impacted loyalty balances and added rewards.
Who was affected
The later notice said the incident affected customers in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont, and Washington, D.C. MarketWatch reported that Chick-fil-A said fewer than 2% of Chick-fil-A One loyalty-program participants were affected.
What readers should understand
Chick-fil-A One is the company’s loyalty program. The records available do not make clear whether the March 2023 notice and the later statement describe separate incidents or the same broader problem. They also do not say whether any personal information was actually misused. The notices say the information may have been exposed, not that it was confirmed to have been used.
