American fast-food restaurant chain Chick-fil-A is alerting an undisclosed number of customers about a data breach after their accounts were compromised during recent credential stuffing attacks.

Describing itself as the third-largest quick-service restaurant company in the United States, Chick-fil-A runs more than 3,000 locations and offers catering services throughout the U.S., Canada, Puerto Rico, the United Kingdom, and Singapore.

The company disclosed in breach notification letters sent to impacted customers and submitted to various Attorney General offices that it identified the attacks after spotting unusual login attempts on select Chick-fil-A One accounts.

During its investigation, Chick-fil-A found that the attackers focused on the company's website and mobile app throughout June.

"After a thorough review, we concluded that unauthorized actors carried out an automated assault on our website and mobile application from June 17 to June 19, 2026, employing login details such as email addresses and passwords taken from an external source," the company stated. "Our investigation revealed on July 13, 2026, that these unauthorized actors could have viewed details from your Chick-fil-A One account."

Exposed details include customer names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers, QR codes, Chick-fil-A credit balances, and the final four digits of credit or debit cards. Attackers may have also obtained birth dates, phone numbers, and addresses when present in the affected accounts.

Although Chick-fil-A did not specify the total number of breached accounts, it informed the Texas Attorney General that the incident affects 2182 residents in Texas. Notification letters were also sent to individuals in Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.

Credential stuffing involves automated tools that attempt account access with stolen username and password combinations, proving especially successful when users repeat credentials across sites. The aim is typically to obtain personal or financial data for resale or further crimes like identity theft.

To address the issue, Chick-fil-A logged out all affected accounts, deleted stored payment methods, reinstated Chick-fil-A One balances, and added rewards to impacted accounts as an apology. The chain recommended that affected users update their passwords promptly since the breaches relied on stolen credentials.

A Chick-fil-A spokesperson could not provide immediate comment when reached by BleepingComputer on Tuesday regarding the exact number of customer accounts involved.

Chick-fil-A previously confirmed in March 2023 that threat actors had accessed personal details and used reward balances of more than 71,000 customers following similar credential stuffing attacks from December 2022 to February 2023.