Nobody Breached Anything; They Just Logged In

Credential stuffing attacks against Chick-fil-A’s mobile app and website in June 2026 exposed membership and payment data. The company’s systems were not exploited; valid credentials were presented and accepted.

Credential stuffing works because people reuse passwords. The credentials come from breaches elsewhere — frequently the aggregated infostealer corpora filed in 26-0615 — and are tried at scale against unrelated services.

That produces an awkward accountability position. Nothing in the target’s environment failed in the conventional sense, yet the outcome is customer data disclosed, and pointing at password reuse is both accurate and useless to the affected customer.

The available controls are well understood: rate limiting by identity rather than by address, detection of distributed low-and-slow attempts, checking submitted credentials against known-compromised corpora, step-up authentication on anomalous sign-ins, and not storing a payment instrument in a way a session alone can use.

The reason they are unevenly deployed is that each adds friction to a consumer login flow measured on conversion. This is a product decision presented as a security one, and it is worth naming as such.

Quick-service ordering apps are built around a saved payment method and one-tap reorder. That design makes account takeover directly monetisable without any further compromise: the attacker does not need the card number, only the session.