[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl1G3QwKk1F_4Gx8o5857UOLhOhB-tEdY0Wy5DaCvMwE":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"1ff5b83d-92a6-4dbd-b2e0-59fa78d57acc","Chick-fil-A discloses data breach after credential stuffing attacks","chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks-f19e3d","American fast food restaurant chain Chick-fil-A is notifying customers of a data breach after their accounts were hacked in a wave of recent credential stuffing attacks. [...]","Chick-fil-A is notifying customers of a data breach resulting from credential stuffing attacks that targeted its website and mobile app in June 2026. Attackers used credentials obtained from a third-party source to access customer accounts, potentially exposing names, email addresses, membership numbers, payment details, and other personal information. The company is taking steps to mitigate the impact, including logging out affected accounts and advising users to change passwords.","Chick-fil-A discloses data breach after credential stuffing attacks on customer accounts.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchick-fil-a-discloses-data-breach-after-credential-stuffing-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F22\u002FChick-fil-A-sign.jpg","2026-07-22T06:40:29+00:00","2026-07-22T08:00:19.703845+00:00",7,[17,20],{"name":18,"type":19},"Chick-fil-A One","product",{"name":21,"type":22},"Chick-fil-A","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"malware","credential stuffing attacks","Attack method used to breach Chick-fil-A accounts.",[21,18],{"controls":48,"vendors":132},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":79,"name":80,"problem":81,"products":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,119,126],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":116,"url":117,"description":118},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":108,"product_name":123,"url":124,"description":125},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":149},"credential-stuffing-attack-exposes-chick-fil-a-customer-data","Credential Stuffing Attack Exposes Chick-fil-A Customer Data","Chick-fil-A suffered a credential stuffing attack where threat actors leveraged usernames and passwords stolen from third-party breaches to systematically gain unauthorized access to customer accounts. This attack succeeded because customers reused passwords across multiple platforms, and the application lacked robust controls to detect or block automated login attempts at scale. The breach exposed sensitive personal and payment information, highlighting that even organizations with strong internal security can be undermined by weak user password hygiene and insufficient bot-mitigation controls. This matters because credential stuffing attacks are inexpensive to execute at scale and will continue to succeed as long as password reuse remains common and applications fail to enforce strong authentication barriers.",[138,139,140,141,142,143,144,145,146,147,148],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-63B: Digital Identity Guidelines – Authentication","NIST AC-2: Account Management","NIST AC-7: Unsuccessful Logon Attempts","NIST SI-10: Information Input Validation","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","OWASP Credential Stuffing Prevention Cheat Sheet","PCI DSS Requirement 8: Identify Users and Authenticate Access",{}]