Chick-fil-A data breach may have exposed customer information in New York, 9 other states

Chick-fil-A said a data breach potentially exposed sensitive information of customers in New York and at least nine other states.

In a letter to loyalty members on Monday, the fast-food chain said its website and mobile app experienced a cyberattack between June 17 and 19. Using customer email addresses and passwords, the breach accessed information, including membership numbers, the last four digits of credit/debit card numbers, Chick-fil-A credit balances, phone numbers, addresses and birthdays.

"Based on our investigation, we determined on July 13, 2026, that the unauthorized parties may have accessed information in your Chick-fil-A One account," the chain said.

The letter, which was posted online by the state of Massachusetts, indicated that the data breach affected customers in New York, Iowa, Maryland, Massachusetts, New Mexico, North Carolina, Oregon, Rhode Island and Vermont. 

Chick-fil-A did not state how many customers were affected.

Texas also separately said 2,182 customers were affected by the data breach, according to the Office of Texas Attorney General Ken Paxton.

Chick-fil-A said it reset the affected account passwords and urged customers to create strong new passwords.

"As soon as Chick-fil-A discovered the incident, we immediately took action to protect customers’ accounts, which included forcing log-outs of affected accounts and removing any stored payment methods," the letter said.

The chain also restored impacted customers’ account balances as well as added rewards.

"Chick-fil-A continues to enhance its security, monitoring, and fraud controls as appropriate to minimize the risk of any similar incident in the future," the letter said.

The chain serves chicken-based meals in more than 3,000 locations in 48 states and Washington, D.C., Puerto Rico and Canada, its website said. There are more than 70 stores in New York and 14 on Long Island.