Cyberattack may have exposed Chick-fil-A customer data in 10 states, including New York, Massachusetts and Maryland
Chick-fil-A is alerting customers in 10 states after a cyberattack gave hackers potential access to personal information stored in some Chick-fil-A One loyalty accounts.
The company said it recently detected suspicious login activity involving certain customer accounts and launched an investigation.
The Georgia-based fast-food chain determined that between June 17 and June 19, unauthorized parties used usernames and passwords obtained from a third-party source in an automated "credential-stuffing" attack targeting its website and mobile app. On July 13, the company concluded the attackers may have accessed information in affected accounts.
According to data breach notification letters sent to customers in the District of Columbia, Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island and Vermont, the information that may have been accessed includes customers' names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers and QR codes, the last four digits of payment card numbers and Chick-fil-A gift card balances.
"Chick-fil-A continues to enhance its security, monitoring, and fraud controls as appropriate to minimize the risk of any similar incident in the future," the letter states.
If customers stored the information in their accounts, attackers also may have accessed the month and day they were born, phone number and address.
Chick-fil-A said it forced affected customers to log out of their accounts and remove stored payment methods while it restored impacted Chick-fil-A One balances. The company said it also added rewards to affected accounts for the inconvenience.
Customers are encouraged to reset their Chick-fil-A passwords immediately and use a strong, unique password that isn't used on other websites. Chick-fil-A also recommends reviewing account activity, bank and credit card statements, and credit reports for any suspicious activity.
