CFA Properties
Chick-fil-A is warning customers that hackers broke into some Chick-fil-A One rewards accounts using stolen passwords. Accounts that were accessed may have had their names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers and QR codes, the last four digits of a payment card, and Chick-fil-A One account balances exposed. Birth month and day, phone number, and address may also have been exposed for customers who had saved that information to their account.
The break-in was traced to an automated attack against its website and app between June 17 and June 19, according to a breach notification letter (PDF) filed with the Massachusetts Attorney General's office and several other states. The hackers didn't steal passwords from Chick-fil-A directly. Instead, they used email and password combinations already leaked in other companies' breaches, then tested them against Chick-fil-A One accounts, a technique known as credential stuffing.
Read more: The best password managers to protect your accounts
Chick-fil-A says it identified the suspicious login activity and determined the scope of the breach on July 13, then began sending notification letters to affected customers on July 20. The company has not disclosed how many customers were affected nationwide. State disclosures show that 2,182 Texas residents and 39 Massachusetts residents were affected, while notices also reference customers in Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Washington, D.C.
As soon as it discovered the breach, Chick-fil-A logged the affected accounts out and removed any saved payment methods. The company also restored any impacted Chick-fil-A One account balances and added rewards to affected accounts as an apology. Chick-fil-A did not say whether any account balances had actually been spent or changed by the attackers before being restored.
If you have a Chick-fil-A One account, change your password now, and don't reuse it anywhere else. Since this attack relied on passwords stolen from other companies' breaches, check whether your email address turns up in past leaks at a site like Have I Been Pwned, then update any account still using that same password. Review your Chick-fil-A order history and account balance for purchases or changes you do not recognize. Also check statements for any payment card that was saved to the account, particularly for unauthorized funds loaded into Chick-fil-A One.
Read next: Fairlife shortage looms after ransomware hits Coca-Cola plants
