Iowa Chick-fil-A Customers Warned After Data Breach Potentially Exposes Personal Information

Some Iowa Chick-fil-A customers may have had personal information exposed following a cyberattack that targeted the restaurant chain's website and mobile app earlier this summer.

According to notification letters sent to affected customers, unauthorized access occurred between June 17 and June 19, 2026, involving some Chick-fil-A One loyalty program accounts.

The company said it determined on July 13 that hackers may have accessed customer account information during the incident.

Getty Images

What Information May Have Been Exposed?

The information involved varies by customer but may include:

• Name
• Email address
• Chick-fil-A One membership number
• Last four digits of a stored credit or debit card
• Chick-fil-A account credit or rewards balance
• Birthday
• Phone number
• Mailing address

Chick-fil-A said only certain customers were affected, and the breach notification applies to residents in Iowa, Washington, D.C., Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Texas.

What Chick-fil-A Is Doing About It?

The restaurant chain says it has taken several steps to secure affected accounts, including:

• Logging users out of impacted accounts
• Removing stored payment methods
• Resetting passwords for affected users
• Restoring any Chick-fil-A One reward balances that were impacted

The company also said it added bonus rewards to affected accounts as a gesture of appreciation for customer loyalty.

In its notification, Chick-fil-A said it is strengthening its security, monitoring, and fraud prevention systems to help reduce the risk of similar incidents in the future.

What Iowa Customers Should Do

If you have a Chick-fil-A One account, it's a good idea to:

• Change your password immediately and choose one that is unique and strong.
• Check your Chick-fil-A account for any unauthorized activity.
• Review your bank and credit card statements for unfamiliar charges.
• Monitor your credit reports for signs of identity theft.

Even if you haven't received a notification, using a unique password for restaurant rewards accounts can help protect your personal information in the event of future data breaches.