Chick-fil-A's loyalty app got hit by the same attack twice. Here's why it keeps working

Between June 17 and June 19, 2026, an automated attack hit Chick-fil-A One, the company’s loyalty program. Chick-fil-A determined on July 13 that some customer accounts had been accessed without authorization, and began notifying affected individuals and state regulators later that month. Exposed information included names, email addresses, membership and mobile-pay numbers, account QR codes, stored credit balances, and — for some accounts — dates of birth, phone numbers, and home addresses.

The company hasn’t disclosed a full nationwide count. State filings put a floor under the number: at least 2,182 affected customers in Texas and 39 in Massachusetts, which means the true total, spread across every other state, is almost certainly larger.

What makes this incident worth a closer look isn’t the scale — it’s the method, and the fact that it’s the second time it’s worked.

The attack that doesn’t need a vulnerability

Credential stuffing doesn’t exploit a flaw in Chick-fil-A’s app at all. It exploits something bigger and entirely outside the company’s control: the enormous, continuously growing pool of username-and-password pairs leaked from breaches elsewhere, combined with the simple fact that a lot of people reuse the same password across accounts. An attacker takes that leaked list, points automated tooling at a login page, and tries each pair. Most fail instantly. A small percentage succeed, because that person used the same password somewhere else that already leaked.

Forbes’ coverage of the disclosure notes this isn’t Chick-fil-A’s first time: a similar attack compromised more than 71,000 accounts between December 2022 and February 2023. Same technique, three and a half years apart, against the same product — a sign of how structurally hard credential stuffing is to close off, since its raw material keeps replenishing regardless of what any single target does.

Why this matters past the loyalty-app world

It’s easy to file this under “consumer app security” and move on. Don’t — the same technique is pointed at business tooling constantly, including the accounts closest to your sending reputation: your email platform login, your mailbox webmail access, your CRM, any API key saved in a password manager or a shared document. The stakes there are higher than a stolen loyalty balance. An attacker who stuffs their way into a mailbox or sending account doesn’t just see your data — they can send mail from it, carrying your domain’s full, legitimately authenticated reputation. A takeover of a trusted account is a different problem than a spoofed message from an unrelated domain, because it passes every authentication check a receiving mailbox runs — the mail genuinely is from your account, just not from you.

Where Norbelys draws this boundary

Mailbox and integration credentials on Norbelys are encrypted at rest and never returned by the API once stored, and every API key is scoped to exactly the access it was created for — so a compromised key from a stuffing attempt or a leaked secret can’t be quietly widened into full account access. That’s the same design principle behind why the developer-facing surface treats credentials as write-only, on purpose: the platform sending your campaigns shouldn’t be the weak link that turns someone else’s leaked password list into access to your domain’s reputation.

If your team is doing the individual-account hygiene above already, the next step is making sure the platform you’re sending through holds up its end too. See how Norbelys handles account and API security across every plan — it’s not a Scale-tier add-on, it’s how the platform is built from Starter up. Start sending from a platform that treats your credentials as write-only from day one.

Credential stuffing — quick answers

What is credential stuffing, in plain terms?+

An automated attack that tries username-and-password pairs leaked from other companies' breaches against a different login page, betting that some people reused the same password. It doesn't require finding a vulnerability in the target system — only that enough people reused a password that leaked somewhere else.

Was this Chick-fil-A's first credential-stuffing incident?+

No. A similar attack compromised more than 71,000 Chick-fil-A One accounts between December 2022 and February 2023. The June 2026 attack is the second confirmed credential-stuffing incident against the same loyalty program.

Why does a consumer loyalty-app breach matter for cold email or sending domains?+

The same automated technique targets business logins — email platforms, mailbox webmail, CRMs, and saved API keys — with much higher stakes than a stolen loyalty balance. A stuffed credential that reaches a mailbox or sending account lets an attacker send fully authenticated mail from your actual domain, which is harder for recipients and mailbox providers to distinguish from legitimate mail than an external spoofing attempt.

What's the single most effective defense?+

Unique, generated passwords per account combined with multi-factor authentication on anything that can send mail or access your contact data. Both defeat credential stuffing directly, because the attack depends entirely on a password being reused somewhere the attacker can find it.