The data breach involved “unauthorized parties” who could have obtained personal information including names, addresses and financial information between June 17 and June 19, according to a copy of the data breach notification letters sent to affected customers. The incident could have affected a total of 2,182 Texans, according to the Texas attorney general’s office, which reported the breach on Tuesday.
“We regret that this incident occurred and apologize for any inconvenience it may cause you,” Chick-fil-A wrote in the letter to an affected customer on Monday.
Chick-fil-A did not immediately return a request for comment.
The letter includes instructions on how to learn about avoiding identity theft for residents in nine states and Washington, D.C.; Texas was not included in that list of states.
Company officials said they first noticed “suspicious login activity” in some Chick-fil-A One accounts and determined that the unauthorized parties targeted its website and app using account credentials from a third party. Chick-fil-A proceeded to force affected accounts to log out, removed stored payment methods and restored the balances in loyalty accounts, according to the restaurant.
Company officials did not share more information about any potential theft in the letter.
“As soon as Chick-fil-A discovered the incident, we immediately took action to protect customers’ accounts,” the restaurant’s letter states.
Company officials said they added rewards to loyalty accounts to thank customers, and they plan to continue strengthening security monitoring and fraud controls. Account holders can call 888-201-5329 for more information.
This story may be updated.