Consumer Apps · Restaurant/Loyalty App · Private litigation
Chick-fil-A (One app)
Headline
Chick-fil-A's loyalty app accounts were compromised in 2023, and a resulting class action — reportedly accusing the company of an 'utter failure to implement basic cybersecurity policies'…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Chick-fil-A's loyalty app accounts were compromised in 2023, and a resulting class action — reportedly accusing the company of an 'utter failure to implement basic cybersecurity policies' — was settled in 2023 on undisclosed terms (the March 2023 breach affected about 71,000 customers). A second credential-stuffing incident followed on June 17-19, 2026, when attackers used email/password pairs from a third-party source against Chick-fil-A One accounts; state breach filings put the affected count at about 13,300 (including 2,182 Texans). An earlier draft's claim that MFA was offered but not required was not verified.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Chick-fil-A settled a Georgia class action over delivery pricing in Oct. 2023 for $4.4 million ($1.45M cash plus $2.95M in gift cards, no admission of fault), which alleged it advertised free or low-cost delivery while raising food prices on delivery orders; it agreed to disclose that delivery prices may be higher. Separately, reportedly named (not independently verified this pass) in a plaintiff-firm mass-arbitration investigation (with McDonald's, Grubhub, Uber Eats, TurboTax, StubHub, and others) over allegedly illegal 'junk fees' and 'drip pricing' added late in the ordering process for delivery orders placed through the Chick-fil-A website/app.
Data sharing
TWO SEPARATE, DISTINCT PRIVACY ISSUES: (1) a DATA BREACH (notified Mar. 2, 2023; Maine AG breach notice lists 71,473 affected and a breach window of Dec. 18, 2022-Feb. 12, 2023) exposed the Chick-fil-A One loyalty app, where customers who stored payment methods and personal information (encouraged via rewards incentives) had accounts compromised — loyalty points were stolen and fraudulently redeemed, some customers lost real money, and whether the app required two-factor authentication was not verified; the lawsuit specifically argues Chick-fil-A created the conditions for harm by incentivizing customers to store sensitive data without adequate security. Chick-fil-A settled this data-breach suit in 2023 on undisclosed terms; the March 2023 breach affected about 71,000 customers (Meatingplace, Oct. 2023). (2) SEPARATELY, a Video Privacy Protection Act (VPPA) class action reportedly alleges (not independently verified this pass) Chick-fil-A used the Meta Pixel on its 'Stories of Evergreen Hills' animated content site to transmit video-viewing data (URL, video title) tied to a visitor's Facebook ID, allowing Facebook to determine which specific individuals watched which specific videos — part of the same VPPA/tracking-pixel litigation wave affecting many other companies in this tracker.
Fees and billing
See arbitration column — the delivery junk-fee investigation is fee-related, distinct from the data-breach and VPPA issues above.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy chick-fil-a.com/legal/privacy | Not fetched yet | NO (HTML only) |
| Terms of service chick-fil-a.com/legal/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.