Chick-fil-A has confirmed that a cyberattack may have compromised the personal data of some loyalty program members across nine states and Washington, D.C., raising fresh concerns about consumer privacy in the fast-food industry.
The company acknowledged in a statement that it detected “suspicious login activity” affecting certain Chick-fil-A One accounts. The breach, which targeted the popular rewards program, potentially exposed names, email addresses, and other personal details.
“Upon discovering the issue, we took steps to immediately address, secure, and restore accounts, and we are communicating directly with all customers who may have been impacted,” Chick-fil-A said in a letter to affected customers. The company apologized for any concern the incident may have caused and reiterated its commitment to protecting customer information.
According to the notification letters, the affected states include Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont, as well as the District of Columbia. Other reports indicate that more than 2,000 accounts in Texas were also compromised.
In response, Chick-fil-A has reset passwords for all impacted accounts and urged members to update their login credentials with strong, unique passwords. The company also advised affected customers to consult guidance from their state attorney general’s office to guard against identity theft and fraud.
This incident comes amid a broader wave of cyberattacks targeting consumer data across the food and retail sectors, with companies scrambling to shore up digital defenses. The breach also highlights the vulnerabilities of loyalty programs, which collect vast amounts of personal information. As the Trump administration pushes to expand data center pledges to utilities and states to shield ratepayers from AI boom costs, such incidents underscore the growing stakes in cybersecurity policy.
For customers seeking assistance, Chick-fil-A has set up a dedicated support line at (888) 201-5329, available Monday through Friday from 9 a.m. to 9 p.m. EDT. The company has not disclosed the total number of affected accounts or the specific method used by attackers, but it is cooperating with law enforcement and conducting a full investigation.
Political observers note that data breaches like this one often fuel calls for stronger federal privacy regulations, a debate that has intensified as lawmakers on both sides of the aisle scrutinize corporate data practices. Meanwhile, the incident serves as a reminder for consumers to remain vigilant about their digital footprints, even when dining out.
