Chick-fil-A has notified customers of a data breach in the fast-food restaurant’s rewards program.
According to the Commonwealth of Massachusetts 2026 Data Breach Notification Report and a letter dated July 20 that was sent to consumers and several state Attorney General offices, Chick-fil-A said it had identified “suspicious login activity to certain Chick-fil-A One accounts.”
Bleeping Computer, a technology publication, was the first outlet to report the news.
In its letter, Chick-fil-A said it determined that “unauthorized parties” attacked the company’s website and mobile application last month between June 17 and June 19.
The hackers allegedly used account credentials -- email addresses and passwords -- obtained from a third-party source, Chick-fil-A said.
“Based on our investigation, we determined on July 13, 2026, that the unauthorized parties may have accessed information in your Chick-fil-A One account,” the company wrote.
The company added that compromised information could have included customers’ names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers, QR codes, the last four digits of credit or debit cards and the balance on the Chick-fil-A One card.
If saved to a consumer’s account, the month and day of their birthday, telephone number and address may also have been hacked, Chick-fil-A wrote.
Chick-fil-A has not publicly revealed the total number of affected customers nationally.
“Chick-fil-A takes the protection of personal information seriously,” the company said. “As soon as Chick-fil-A discovered the incident, we immediately took action to protect customers’ accounts, which included forcing log-outs of affected accounts and removing any stored payment methods.
“We also restored impacted customers’ Chick-fil-A One account balances.”
Customers with questions can contact Chick-fil-A at its call center, at 888-201-5329, from 9 a.m. to 9 p.m. ET on Mondays through Fridays.
“We regret that this incident occurred and apologize for any inconvenience it may cause you,” Chick-fil-A wrote.