What does the Chick-fil-A cyberattack mean for Maryland customers?
Chick-fil-A says hackers stole some customer data from its app following a cybersecurity breach.
Cyber experts told CBS News Baltimore that this type of scam is becoming too common because people use the same login credentials for multiple sites.
"They know about one place, then they try other places to see if they can get in with the same username and password," Dr. Anton Dahbura, Co-Director of the Johns Hopkins Institute for Assured Autonomy, said.
The cyberattack impacted Chick-fil-A One Loyalty accounts in 10 states, including Maryland. The company said it recently detected suspicious login activity involving certain customer accounts and launched an investigation.
The fast-food chain says between June 17 and June 19, unauthorized parties used usernames and passwords obtained from a third-party source in an automated "credential-stuffing" attack targeting its website and mobile app. On July 13, the company concluded that the attackers may have accessed information in affected accounts.
According to data breach notification letters sent to customers, the information that may have been accessed includes customers' names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers and QR codes, the last four digits of payment card numbers, and Chick-fil-A gift card balances.
How to protect yourself from cyberattacks
Dahbura said cyberattacks give hackers more of your personal data, which they collect to cause even more damage.
"They're collecting pieces of information," Dahbura said. "They might not get everything from one place from you for it to be helpful for them, but it's the combination of places. They patiently collect information about you, and pretty soon, they have enough information to do things that can be quite damaging."
Use strong passwords, back up your own data, use ransomware protection, and don't reuse passwords to keep yourself safe.
"Enterprises need to do a lot more to ensure that they don't continue happening," Dahbura said.
To sign up for an app like this, customers often have to give an email address, phone number, name, and even date of birth. Sometimes financial information is also stored in accounts like this, which is sometimes forgotten about.
"Makes me hesitate to get another app"
Now some people say they're thinking twice before downloading another app like this again.
"It definitely makes me hesitate to get another app like this for sure," Isabel Maloney told WJZ. "I probably won't use it moving forward just after hearing about that."
In a statement, Chick-fil-A said the hack impacted a limited number of loyalty accounts. It immediately secured and restored impacted accounts and apologizes for any inconvenience.
"We recently identified a security incident that may have affected a limited number of Chick-fil-A One Loyalty accounts. Upon discovering the issue, we took steps to immediately address, secure and restore accounts, and we are communicating directly with all customers who may have been impacted. We sincerely apologize for any inconvenience or concern this situation may have caused and remain committed to maintaining the trust our guests place in us every day," said a Chick-fil-A, Inc. spokesperson.
