Loading story…
Chick-fil-A disclosed a data breach after attackers used credential stuffing to access customer Chick-fil-A One loyalty accounts through the company’s website and mobile app. The automated login activity occurred between June 17 and June 19, with the company later determining that account information may have been accessed after usernames, email addresses, and passwords obtained from third-party sources were used to take over some accounts. The incident was described as account takeover through reused credentials rather than a direct compromise of Chick-fil-A’s internal systems.
Potentially exposed data included names, email addresses, membership numbers, mobile pay numbers, QR codes, stored credit or balance amounts, and the last four digits of payment cards; some accounts may also have exposed birth dates, phone numbers, and physical addresses. Chick-fil-A said it logged out affected users, reset passwords, removed stored payment methods, restored balances, and terminated active sessions during the investigation, while also notifying impacted individuals across multiple jurisdictions, including 2,182 Texas residents.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Chick-fil-A said it detected suspicious login activity in June 2026 while investigating the account takeover activity. The company identified that the attacks involved automated login attempts against customer accounts.
In response to the incident, Chick-fil-A logged out impacted accounts, reset passwords or terminated active sessions, removed stored payment methods, and restored balances where needed. The company also advised affected users to change their passwords.
On July 20, 2026, Chick-fil-A began notifying affected customers about the credential stuffing incident and started filing breach notices with state authorities. This followed the company's investigation into unauthorized access to a limited number of customer accounts.
On July 13, 2026, Chick-fil-A determined that information in affected customer accounts may have been accessed during the credential stuffing attacks. Potentially exposed data included names, email addresses, membership numbers, QR codes, balances, limited payment card details, and for some users birth dates, phone numbers, and addresses.
Automated credential stuffing attacks targeted Chick-fil-A's website and mobile app using email addresses and passwords obtained from third-party sources. The activity occurred between June 17 and June 19, 2026 and led to unauthorized access to some Chick-fil-A One customer accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
9 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceteiss.co.uk
Open sourcetechrepublic.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcebleepingcomputer.com
Open sourcefoxbusiness.com
Open sourcemass.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Customer data tied to **Central Tickets** and **AT&T** surfaced on hacking forums, exposing large volumes of personally identifiable information and raising questions about how long the records had circulated before becoming public. Central Tickets data posted in September 2024 affected **723,000** unique email addresses and included names, phone numbers, IP addresses, purchase records, and passwords; the breach likely occurred months earlier. The password data was reportedly stored as **unsalted `SHA-1` hashes**, pointing to weak credential protection. A separate leaked dataset allegedly linked to **AT&T** contained **tens of millions** of records and was publicly posted after first being offered for sale in 2021. The exposed information included names, email and physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers. AT&T initially said its systems had not been breached, then later acknowledged the dataset contained AT&T-specific fields and said it remained unclear whether the compromise originated inside AT&T or through a vendor; the company subsequently reset customer account passcodes.
Jun 29, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
Spanish technology retailer **PcComponentes** denied claims that attackers stole a customer database affecting roughly **16 million** users after a threat actor, **“daghetiaw,”** alleged theft of **16.3 million** records, leaked a sample (reported as **~500,000** records), and offered the remainder for sale. The allegedly exposed data was described as including customer PII and commerce/support artifacts such as names, physical addresses, phone numbers, IP addresses, order details, wish-lists, and customer support messages (including exchanges via *Zendesk*). PcComponentes stated its investigation found **no evidence of unauthorized access** to its databases or internal systems and disputed the claimed scale, noting the number of active accounts is significantly lower; it also said it does not store customer passwords or financial details. PcComponentes confirmed it experienced a **credential stuffing** attack, in which attackers attempt logins using reused email/password pairs sourced from other breaches. Threat intelligence firm **Hudson Rock** assessed the credentials likely originated from endpoints infected with **info-stealing malware**, aligning with the credential-reuse pattern. In response, PcComponentes implemented additional controls including **CAPTCHA** on login pages, **mandatory 2FA** for all accounts, and **session invalidation** requiring users to re-authenticate and enable 2FA.
Jun 29, 2026