Chick-fil-A Data Breach Affects Over 13,000 Customers

What Happened

Chick-fil-A, one of America's largest fast-food chains, is in the news for a new cybersecurity incident affecting tens of thousands of its customers. The company has officially confirmed that 13,322 of its customers' Chick-fil-A One loyalty program accounts were compromised as a result of a series of "credential stuffing" attacks. According to the announcement, the attacks took place between June 17 and June 19. The company became aware of the incident after detecting suspicious login activity on certain accounts via its website and mobile app.

This is not the first major cyberattack Chick-fil-A has faced. In March 2023, the company disclosed that the personal information of over 71,000 customers was stolen in a similar wave of credential stuffing attacks. That attack, which occurred between December 2022 and February 2023, highlighted the significant challenges to the company's cybersecurity defenses. This latest incident once again shows that attackers continue to target popular brands and their customer loyalty programs. Such programs are attractive targets for cybercriminals as they often contain valuable assets like credit card information, personal data, and redeemable points. The constant stream of new Data Breach News serves as a reminder for users to take their digital security more seriously.

Data Compromised

The attackers gained access to a wide variety of sensitive information through the compromised accounts. According to Chick-fil-A's statement and documents filed with various state attorneys general, the leaked data includes:

• Full Name: Basic information that can be used to verify customers' identities.
• Email Addresses: A critical piece of data for future phishing attacks and other fraudulent activities.
• Chick-fil-A One Membership Number: A unique identifier for the account.
• Chick-fil-A Credit Balance: The amount of accumulated and spendable points or money in the accounts.
• Mobile Pay Number: The number associated with payments made through the app.
• Last Four Digits of Credit/Debit Card: Although not the full card number, this information can be combined with other data for use in social engineering attacks.

Additionally, it is noted that if users had saved this information in their profiles, the attackers may have also accessed more personal data such as birth dates, phone numbers, and home/work addresses. The combination of this data creates a fertile ground for identity theft and targeted fraud.

How the Attack Happened

Chick-fil-A stated that the attack was carried out using a method called "credential stuffing." This is a very common and unfortunately effective type of attack in the cybersecurity world. In this method, attackers do not hack Chick-fil-A's systems directly. Instead, they use massive lists of username and password combinations that have been stolen in previous large-scale data breaches (e.g., from another social media platform, e-commerce site, or forum).

The attackers take these lists and use automated software (bots) to try them on Chick-fil-A's website or mobile app. The success of the attack relies entirely on the user habit of reusing the same password across multiple platforms. If a user has used a password for their Chick-fil-A account that was also leaked from another site, the bots will find this match and gain unauthorized access to the account. The company confirmed this method by stressing that the credentials used by the attackers were "obtained from a third-party source." This situation once again highlights how vital it is to use strong, unique passwords for every platform.

Who Is Affected

According to documents shared by the Office of the Maine Attorney General, a total of 13,322 people were affected by the data breach. The company also provided information on the number of affected users in different states. For instance, it was reported that data of 2,182 customers in Texas and 39 in Massachusetts was breached. Chick-fil-A also sent notification letters to affected customers residing in states such as the District of Columbia, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.

Those affected by the attack are customers who are members of the Chick-fil-A One loyalty program and who reused their passwords on other platforms. If you are a member of this program and suspect your password may be insecure, you can use a Data Breach Search tool to check if your data has been compromised.

What You Can Do

If you are a Chick-fil-A customer or have received a notification that you were affected by this incident, there are several steps you should take to secure your account and personal information:

• Change Your Password Immediately: The first thing you should do is change your Chick-fil-A account password. Make sure your new password is strong, complex, and unique—one you have never used anywhere else.
• Stop Reusing Passwords: If you used the same password for Chick-fil-A on other services like email, social media, or banking, change those passwords immediately as well. A compromise of one account can lead to a domino effect, toppling others.
• Enable Two-Factor Authentication (2FA): Activate 2FA on every service that offers it. This is an additional layer of security that prevents an attacker from accessing your account even if they have your password.
• Monitor Your Accounts: Regularly check your Chick-fil-A account balance for any movements and review your bank/credit card statements for suspicious transactions.
• Be Wary of Phishing Attacks: Attackers may use your stolen email address and name to send you convincing fake emails. Before clicking on links in emails that appear to be from Chick-fil-A and ask for an urgent password change or promise a reward, carefully check the sender's address.

What the Company Says

Chick-fil-A announced that it took a series of measures after detecting the incident. In a statement to BleepingComputer, the company said, "We recently identified a security incident that may have affected a limited number of Chick-fil-A One Loyalty accounts. Upon discovering the issue, we took steps to immediately address, secure and restore accounts, and we are communicating directly with all customers who may have been impacted."

The concrete steps taken by the company include:

• All affected accounts were automatically logged out.
• Payment methods saved in the accounts were removed.
• All Chick-fil-A One account balances and points that were improperly spent during the attack were restored.
• As a form of apology, additional rewards were added to the affected accounts.

Furthermore, the company stated that the root cause of the attack was the reuse of passwords stolen from other services and advised all affected customers to change their passwords as soon as possible.

Source

https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/