ATLANTA, July 23 (Nationwide Times) — Chick-fil-A says a recent security incident may have exposed personal information tied to a limited number of Chick-fil-A One loyalty accounts. The company said it moved quickly to secure affected accounts and notify customers who may have been impacted.
What happened?
Chick-fil-A said unauthorized parties targeted its website and mobile app between June 17 and June 19. The company said the attackers used account credentials obtained from a third-party source. Chick-fil-A One is the company’s loyalty program.
The company said it notified potentially affected customers after it found suspicious login activity involving certain accounts. It also said it reset passwords for affected accounts, restored loyalty balances and added rewards to customer accounts.
What information may have been exposed?
Chick-fil-A said the information that may have been compromised included names, email addresses, Chick-fil-A One membership numbers, mobile payment numbers, the last four digits of payment cards and the amount of Chick-fil-A credit stored in accounts.
The company said customers in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Washington, D.C., were affected.
How many accounts were involved?
Chick-fil-A has described the incident as involving a limited number of accounts. MarketWatch reported that the company said fewer than 2% of Chick-fil-A One loyalty program participants were affected. The company did not give a total account count in the notices reviewed for this explanation.
Why is Massachusetts part of the record?
Chick-fil-A also filed a March 2, 2023, notice with Massachusetts about suspicious login activity involving certain Chick-fil-A One accounts between Dec. 18, 2022, and Feb. 12, 2023. In that notice, the company said that on Feb. 12, 2023, it determined unauthorized parties had accessed information in affected accounts.
That Massachusetts notice said the information may have included a name, email address, membership number, mobile pay number, QR code, masked debit or credit card number and Chick-fil-A credit balance. It also said saved birthday month and day, phone number and address may have been included. The notice said unauthorized parties could only view the last four digits of a payment card number.
What did Chick-fil-A say it did?
In the Massachusetts notice, Chick-fil-A said it required password resets, removed stored credit and debit card payment methods, temporarily froze funds loaded onto Chick-fil-A One accounts, restored account balances and added rewards.
The later notice said the company again moved quickly to secure accounts and communicate with customers who may have been affected.
What is still unclear?
The notices do not make clear whether the March 2023 notice and the later June incident are separate events or part of the same broader problem. They also do not say how the third-party credentials were obtained, whether any personal information was actually misused or whether any criminal case has been filed. No suspects or charges are named in the notices.
