Chick-fil-A has disclosed a data breach following credential stuffing attacks against customer loyalty accounts. In this kind of attack there is no flaw in the targeted company's systems: attackers take username and password pairs harvested from unrelated breaches and replay them automatically against a login page, and any customer who reused a password elsewhere has their account opened. Loyalty and rewards accounts are attractive because they often hold stored balances, order history, and partial payment details, and they tend to receive less scrutiny than banking logins. Affected customers are advised to change their password.
Password manager Dashlane locked out multiple users after an external brute-force attack triggered its automated account-suspension defenses. Affected users received emails about suspicious access requests and device-registration codes from foreign locations they did not initiate, prompting confusion about whether the messages were themselves phishing. Dashlane confirmed the suspensions were a built-in security response to credential-stuffing-style login attempts and said there is no evidence its systems were compromised. The company opened an investigation on May 31 at 15:19 UTC and marked it resolved by 22:30 UTC, with all affected accounts unsuspended. The episode shows account-lockout defenses working as designed, though the user-experience and phishing-confusion fallout is real.
TrustStrike Labs