Chick-fil-A is notifying customers whose information was exposed in a recent cyberattack targeting the company’s website and mobile app.
[DOWNLOAD: Free WSB-TV News app for alerts as news breaks]
In a letter sent to affected customers, the Atlanta-based fast-food chain said an automated attack occurred between June 17 and June 19 and targeted customer data associated with its Chick-fil-A One rewards program.
According to disclosure documents filed with attorneys general in several states, including Massachusetts and Texas, the compromised information may include email addresses, phone numbers, mailing addresses, the month and day of birth and the last four digits of payment cards.
Chick-fil-A said the incident affected a “limited number” of Chick-fil-A One loyalty accounts but has not disclosed how many customers were impacted in Georgia or nationwide.
“Upon discovering the issue, we took steps to immediately address, secure and restore accounts, and we are communicating directly with all customers who may have been impacted,” said a Chick-fil-A, Inc. spokesperson. “We sincerely apologize for any inconvenience or concern this situation may have caused and remain committed to maintaining the trust our guests place in us every day.”
The breach comes as data security incidents continue to rise.
According to a new report from the Identity Theft Resource Center, more than 471 million data breach notifications have already been sent to consumers in 2026, surpassing the total number sent during all of 2025.
“Everyone’s information has been or will be compromised at some point. For most of us, it’s multiple times,” said James Lee, president of the Identity Theft Resource Center. “Artificial intelligence is making it so much easier to conduct an attack and so much more efficient when they do.”
Channel 2 Consumer Adviser Clark Howard said consumers should be mindful of the information they share online and consider limiting the personal and financial information stored in mobile apps.
“We have to know that every time we add something to our phone, we’re creating another vulnerability,” Howard said.
Howard also recommends avoiding linking payment cards when possible, using passkeys instead of passwords when available, and regularly reviewing account activity.
Consumers can also help protect themselves by freezing their credit and avoiding calls or messages from unfamiliar numbers.
Georgia law does not require companies to notify the state of data breaches in the same way some other states do.
TRENDING STORIES
- VIDEO: Sandy Springs police use 4 PIT maneuvers to end 110 mph chase
- Metro Atlanta superior court judge facing official charges of misconduct from state commission
- Gwinnett mother accused of leaving 3-month-old in hot car
[SIGN UP: WSB-TV Daily Headlines Newsletter]