Chick-fil-A Lawsuit: The 2026 Account Hack, a Dropped Class Action and What Remains
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
As of September 30, 2026, there is no open Chick-fil-A settlement and no claim form. The lawsuit that made the news in summer 2026 — a proposed class action over the takeover of Chick-fil-A One loyalty accounts in June 2026 — was voluntarily dismissed by the plaintiff on September 1, 2026, before any ruling. A separate text-message (TCPA) class action filed August 13, 2026 is at its first stage. The $4.4 million delivery-price settlement closed to claims on February 15, 2024.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened: Chick-fil-A One Accounts Taken Over in June 2026
Between June 17 and June 19, 2026, automated software tried email-and-password pairs against the Chick-fil-A website and app. The technique is called credential stuffing: it works because people reuse passwords that leaked from other sites. Chick-fil-A determined on July 13, 2026 that the attackers had gotten into affected accounts, and notices to customers began on July 20.
According to the notice Chick-fil-A filed with Massachusetts (as reported by Malwarebytes), the exposed fields were name and email address, Chick-fil-A One membership number and mobile pay number, the account's QR codes, the balance of any Chick-fil-A credit such as gift cards or rewards, and the last four digits of a stored card — plus birthday (month and day), phone number and address if those were saved. Chick-fil-A says it reset passwords and ended active sessions on affected accounts, and that it took steps to “immediately address, secure and restore accounts.”
No nationwide total has been published. State filings reported by CBS News Atlanta list 2,182 accounts in Texas and 39 in Massachusetts. It is not the first time: between December 2022 and February 12, 2023, more than 71,000 Chick-fil-A customer accounts were compromised.
On July 23, 2026, a Texas customer filed a proposed nationwide class action in Atlanta. The complaint alleged that Chick-fil-A failed to protect member accounts, pleaded negligence, breach of implied contract and unjust enrichment, and asked for damages, a declaratory judgment on data-security duties and at least 10 years of credit monitoring. Those were allegations; no court ever tested them.
Case Details
The breach case. Williams v. Chick-fil-A, No. 1:26-cv-04160, U.S. District Court for the Northern District of Georgia, filed July 23, 2026. Judge Michael L. Brown recused on August 10 and the case went to Judge Eleanor L. Ross, who extended Chick-fil-A's deadline to answer to September 17. It never got that far: on September 1, 2026 the clerk entered the dismissal on the plaintiff's own notice under Federal Rule 41(a)(1)(A)(i), and the case was terminated.
The text-message case. Lee v. Chick-Fil-A, Inc., No. 2:26-cv-09018, U.S. District Court for the Central District of California, filed August 13, 2026 under the Telephone Consumer Protection Act. According to a published summary of the complaint, the plaintiff says she never signed up for Chick-fil-A's texts, that one arrived at 7:15 a.m., and that the messages broke the do-not-call and quiet-hour rules; she sues on behalf of similarly situated people. Under the waiver of service, Chick-fil-A's response was due October 16, 2026.
Older consumer cases. The 2023 account breach produced Stephens v. Chick-Fil-A, Inc., No. 1:23-cv-00964 (N.D. Ga., Judge Leigh Martin May), closed October 11, 2023 after the parties reported a settlement in principle. The delivery-price claims were settled in Mayheu v. Chick-fil-A, Inc., No. 2022CV365400, Superior Court of Fulton County, Georgia, together with parallel suits from California, Florida, New Jersey and New York.
Not consumer cases. Chick-fil-A is itself a plaintiff on the buyer side of chicken antitrust litigation: Chick-fil-A, Inc. v. Agri Stats, Inc., No. 1:20-cv-07205 (N.D. Ill., filed December 4, 2020), against Agri Stats and producers including Pilgrim's Pride and Sanderson Farms. The EEOC sued Hatch Trick, Inc., a Chick-fil-A franchisee operating multiple Austin locations, on May 14, 2026 (No. 1:26-cv-01275, W.D. Tex.), alleging it fired an employee instead of accommodating her Saturday Sabbath — background in our EEOC settlement research. And Chick-Fil-A, Inc. v. Cava Mezze Grill, LLC (No. 8:26-cv-02220, M.D. Fla., removed to federal court July 31, 2026) is a business contract dispute. None of these three pays customers anything.
Status as of September 30, 2026: Nothing to Claim
The breach class action is over without a ruling. A plaintiff may drop a federal case by notice before the defendant answers, and unless the notice says otherwise, that dismissal is without prejudice — the claims could be brought again, by this plaintiff or someone else. No class was ever certified, the dismissal did not decide whether Chick-fil-A did anything wrong, and the public docket does not say why the case was dropped.
The text-message case is pending at its opening stage, with no certified class and nothing to join. The most recent Chick-fil-A settlement with a claim form that we found — the delivery-price settlement — closed to claims on February 15, 2024.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Which Case Could Involve You
The June 2026 account hack. You are in the affected group if Chick-fil-A notified you — notices began July 20, 2026. Keep the email or letter: it is the only record that your account was involved. With the lawsuit dismissed, there is no class to be part of right now.
The text-message suit. The complaint seeks to represent “similarly-situated” people, but its exact class definition is not on the free public docket and no court has defined a class. You do not sign up for a proposed class action; if one is certified or settled, a court-appointed administrator sends notice.
The delivery settlement. The class was everyone who placed a Chick-fil-A delivery order through the app or website between November 1, 2019 and April 30, 2021 from a location in California, Florida, Georgia, New Jersey or New York — Chick-fil-A's records showed roughly 400,000 user IDs with purchases in that period. Claims closed February 15, 2024.
Is There Money? Not From Any Open Case
For the text-message suit: the TCPA lets a person sue for up to $500 per violation, and a court may raise that to as much as 3 times the amount for willful or knowing violations. That is the statute's ceiling, not a forecast. For what a comparable text-message class settlement offers, the O'Reilly Automotive spam-text settlement — $18.8 million — pays up to $22 per claimant.
The delivery settlement offered up to $29.25 per claimant in cash or a Chick-fil-A gift card, from a $1.45 million cash fund and a gift-card fund of up to $2.95 million — $4.4 million in total. That money is no longer claimable.
Chick-fil-A Lawsuit Timeline, 2026
- 1
June 17–19, 2026 — Automated Login Attack
Software tries email-and-password pairs taken from another source against the Chick-fil-A website and app, and gets into some Chick-fil-A One accounts.
- 2
July 13, 2026 — Access Confirmed
Chick-fil-A determines that the attackers accessed affected accounts. It says it reset passwords and ended active sessions on those accounts.
- 3
July 20, 2026 — Notices Begin
Customers start receiving breach notices. State filings later show 2,182 affected accounts in Texas and 39 in Massachusetts.
- 4
July 23, 2026 — Class Action Filed in Atlanta
Williams v. Chick-fil-A (No. 1:26-cv-04160, N.D. Ga.) seeks a nationwide class, damages and at least 10 years of credit monitoring.
- 5
August 13, 2026 — Text-Message Suit
Lee v. Chick-Fil-A, Inc. (No. 2:26-cv-09018, C.D. Cal.) is filed under the TCPA, alleging do-not-call and quiet-hour violations.
- 6
September 1, 2026 — Breach Suit Dropped
The plaintiff files a notice of voluntary dismissal before Chick-fil-A answers, and the case is terminated. No class settlement, no ruling on the merits.
Three Things to Watch For
A hack that exposed membership numbers, reward balances and the last four digits of cards, followed by lawsuit headlines, is ideal material for imposters:
“Claim your Chick-fil-A breach payment”
There is no breach settlement, and the lawsuit was dismissed on September 1, 2026. A page or text asking for your full card number or Social Security number to “secure your share” is collecting data, not filing a claim.
Messages that know your membership number
Name, email, Chick-fil-A One membership number, reward balance and the last four digits of a card were exactly the fields exposed. An email quoting them back to you — “your rewards were restored, log in here” — proves nothing about who sent it. Open the Chick-fil-A app you installed yourself instead of following a link.
The closed delivery settlement listed as open
At least one settlement listing advertised a “$1.45M Chick-fil-A Delivery Order” settlement with a September 23, 2026 claim deadline. $1.45 million is the cash fund of the delivery settlement whose claims closed February 15, 2024, and we found no court filing for a new one. The listing's own date has passed as well.
Chick-fil-A Lawsuit — Questions People Actually Ask
Is there a Chick-fil-A class action I can join right now?
No. As of September 30, 2026 there is no open Chick-fil-A settlement and no claim form. The data-breach class action was dismissed on September 1, 2026, and the text-message class action filed in August has no certified class. You never sign up for a proposed class action; if a class is certified or a settlement is reached, a court-appointed administrator sends notice. Settlements that are open today are on our open class action settlements list.
What happened to the Chick-fil-A lawsuit over the data breach?
The plaintiff dropped it. Williams v. Chick-fil-A was filed July 23, 2026 in federal court in Atlanta; on September 1, 2026 the plaintiff filed a notice of voluntary dismissal before Chick-fil-A had answered, and the case was terminated. The docket gives no reason. Under Rule 41, such a dismissal is without prejudice unless the notice says otherwise, so the claims could be filed again.
Was my Chick-fil-A One account hacked?
Chick-fil-A began notifying affected customers on July 20, 2026. If you received a notice, your account was in the group accessed between June 17 and June 19, 2026. If you did not, check the inbox of the email address tied to your account, including the spam folder, and sign in to the app to see whether you were asked to reset your password.
Is there a Chick-fil-A settlement for the data breach?
No. There is no settlement, fund, administrator or deadline for the June 2026 breach. The earlier account breach also ended without a public class settlement: in October 2023 the parties reported a settlement in principle and the case was closed; no claim form for customers was announced.
What is the Chick-fil-A text message lawsuit?
Lee v. Chick-Fil-A, Inc., No. 2:26-cv-09018, filed August 13, 2026 in the Central District of California under the Telephone Consumer Protection Act. It alleges marketing texts sent without sign-up, including one at 7:15 a.m. FCC rules bar telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. local time. The case is at the pleading stage; nothing has been decided and there is nothing to claim.
What was the $4.4 million Chick-fil-A settlement?
The delivery-price settlement. The lawsuits alleged that Chick-fil-A advertised flat, low delivery fees while marking up menu prices on delivery orders by 25–30%; Chick-fil-A denied it. The settlement covered app and website delivery orders from November 1, 2019 to April 30, 2021 in California, Florida, Georgia, New Jersey and New York and offered up to $29.25 in cash or a gift card. Chick-fil-A also revised its app and website to say that menu prices may be higher for delivery orders. Claims closed February 15, 2024.
Is Chick-fil-A part of the chicken price-fixing settlement?
Only as a buyer. Chick-fil-A filed its own antitrust suit against Agri Stats and chicken producers, Chick-fil-A, Inc. v. Agri Stats, Inc. (No. 1:20-cv-07205, N.D. Ill., 2020) — a company suing over what it paid, not a case customers can join. The consumer settlements in the broiler chicken litigation cover people who bought raw chicken at grocery stores and other retailers, not restaurant meals; our chicken price-fixing settlement tracker follows the $203.35 million consumer fund.
What is worth doing right now?
If you used your Chick-fil-A password anywhere else, change it there too — the attack ran on email-and-password pairs taken from another source. Check your Chick-fil-A One reward and credit balance and your card statements for activity you do not recognize, and keep any breach notice you received. For how data-breach payouts are usually structured, see our data breach settlement calculator.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Chicken Price-Fixing Settlement
The $203.35M grocery-chicken consumer fund and its payment status
O'Reilly Spam-Text Settlement
What a comparable TCPA text-message settlement offers
Data Breach Settlement Calculator
What data-breach settlements typically pay, tier by tier
Open Class Action Settlements
Settlements still taking claims, with their deadlines