Customers of Atlanta-based Chick-fil-A were impacted by an automated attack on the company’s website and mobile app between June 17 and June 19. The breach targeted customer data from the Chick-fil-A Rewards app.
Disclosures to state attorneys general, including in Massachusetts and Texas, confirmed the incident.
The Chick-fil-A data breach occurs amid a significant rise in identity theft and data breaches nationwide.
A new report from the Identity Theft Resource Center finds that more than 471 million data breach notifications have been sent out so far in 2026, already surpassing the total for all of 2025.
[DOWNLOAD: Free WHIO-TV News app for alerts as news breaks]
TRENDING STORIES:
- Appeals court ruling extends TPS for Haitians through the weekend
- Man shot, killed inside bar at popular Ohio vacation destination
- 1 in custody after chase ends on I-75 in Shelby Co, OSHP says
The exposed data from the Chick-fil-A Rewards app included email addresses, the last four digits of credit cards, the month and day of birthdays, phone numbers and addresses.
News Center 7’s Consumer Advisor Clark Howard emphasized the inherent risks of digital engagement. “We have to know that every time we add something to our phone, we’re creating another vulnerability,” Howard said. He advises consumers to limit the information they share, avoid linking credit cards when possible, and provide minimal personal details.
Howard also urged critical thinking regarding data sharing. “You always need to think about if I’m sharing this information, what’s the risk to me?” Howard said.
Chick-fil-A stated that a “limited number of Chick-fil-A One Loyalty accounts” were impacted. However, the company has not disclosed how many Georgia accounts were compromised or the total number of affected customers overall.
James Lee, associated with the Identity Theft Resource Center, highlighted the pervasive nature of data compromise. “Everyone’s information has been or will be compromised at some point. For most of us, it’s multiple times,” Lee said. He also noted that artificial intelligence is making it significantly easier and more efficient to conduct cyberattacks.
Ohio law requires that the state be notified of data breaches.
Lee advocates for the use of pass-keys as a vital security measure. “Pass keys are the most underappreciated, underutilized thing available to us,” Lee said.
[SIGN UP: WHIO-TV Daily Headlines Newsletter]
