If you or anyone in your family has the Chick-fil-A app — and around here, that’s most of us — check your email. The company began notifying customers on July 20 that some Chick-fil-A One accounts were accessed by strangers back in June, with letters going out to residents of North Carolina and a number of other states. And before you ask: no, this is not the Bojangles situation all over again. What happened here is a completely different animal — and honestly, a more personal one, because the root cause isn’t in Chick-fil-A’s systems at all. It’s in a habit that most people reading this have.

Here’s the twist worth the whole article: nobody “hacked” Chick-fil-A. The attackers simply logged in — using email addresses and passwords stolen from other websites’ breaches, tried automatically against Chick-fil-A’s login page to see which ones still worked. The technique is called credential stuffing, and it only works for one reason: because people reuse passwords.

What happened, at a glance

Nobody picked the lock. They had keys.

Credential stuffing, in plain English: over the years, breaches at countless websites — shopping sites, forums, games, old services you forgot you ever joined — have spilled billions of email-and-password combinations into criminal hands. Attackers load those lists into automated tools that try each combination against other companies’ login pages, at massive speed, to find where else the same key works. No breaking in, no clever exploit. Just millions of doorknobs tried with millions of stolen keys — and every door opens where somebody reused a password.

The one-sentence lesson: if you reuse a password, then every breach at every website you’ve ever used is a breach of you — everywhere that password works. The attackers didn’t need to touch Chick-fil-A’s security. Your old gym-forum password from 2019 did the work for them.

Why a chicken app, of all things?

Because loyalty accounts are money nobody watches. People guard their bank logins carefully — and then protect the account holding $40 of chicken credit, a stored payment card, and a scannable payment QR code with the same tired password they use everywhere else. Criminals drain the balances, spend the e-gift cards, and harvest the personal details for the next scam. Notice what Chick-fil-A had to do in response: restore balances. That tells you the money was real enough to steal. Rewards accounts, points balances, gift cards — to you it’s lunch; to an attacker it’s untraceable cash with a mediocre lock on it.

The fix costs nothing (and takes one evening)

• One account, one password. No exceptions. Unique passwords turn a breach at some random website back into their problem instead of yours.
• Let a password manager do the remembering. Nobody can memorize eighty unique passwords, and the good news is nobody has to. A password manager creates and fills them for you — it is the single highest-value security habit an ordinary person can adopt.
• Turn on two-step verification wherever it’s offered. Even a stolen password hits a wall when a login needs your phone’s approval.
• Know your blast radius. Ask yourself honestly: the password you use at the places that don’t matter — does it also guard something that does? If your chicken-app password is also your email password, the chicken app was never the real risk.

If you got the Chick-fil-A letter, do it in this order: 1) Change your email password first if it shared a password with anything — email is the master key to every account you own. 2) Set a new, unique Chick-fil-A password. 3) Change that old password everywhere else it lived — every reuse is another open door. 4) Keep an eye on the card ending in those last four digits. 5) Treat any “Chick-fil-A support” call or text that follows as a scam until proven otherwise — breach letters always attract impersonators.

The business half of this story

Two things for the business owners, because this lands on you twice. First: your employees reuse passwords exactly like everyone else, which means a breach at somebody’s hobby forum can hand an attacker the password to your business email, your point-of-sale, or your cloud files. One reused password by one employee is a door into the company — and no firewall on earth closes it. Second: if your business offers customer logins — an online store, a booking system, a client portal — credential-stuffing bots will visit your login page too; they don’t reserve this treatment for national chains. Security researchers made a fair point about this incident: customers who reuse passwords make these attacks possible, but businesses share the responsibility to notice and block a robot hammering their front door.

Both halves have the same answer: habits, taught well. Our focused, plain-language security training covers exactly this — password managers, two-step verification, and the reuse trap — for the actual humans on your team, in under an hour, without a syllable of jargon. Chick-fil-A can restore a chicken balance. Nobody can restore a business email account to “never compromised.” Build the habit before the bots find the door.

Sources: Chick-fil-A customer notification; BleepingComputer; Malwarebytes; Forbes; SC Media; state attorney general filings, July 2026.