Chick-fil-A One Data Breach Lawsuit Dismissed Without Prejudice After 2026 Account Attack

A putative class action against Chick-fil-A, Inc. over a June 2026 attack on Chick-fil-A One accounts was voluntarily dismissed without prejudice on September 1, 2026. The case ended with no settlement, no payment to customers and no claim form.

Brian Williams filed Williams v. Chick-fil-A, Inc., No. 1:26-cv-04160, in the U.S. District Court for the Northern District of Georgia on July 23, 2026. The complaint was filed as a class action and included a jury demand. No class was ever certified.

Williams filed a notice of voluntary dismissal on September 1, 2026, under Federal Rule of Civil Procedure 41(a)(1)(A)(i), and the clerk terminated the case the same day. The court never ruled on the allegations.

The underlying incident was real: Chick-fil-A said an automated attack hit its website and mobile app between June 17 and June 19, 2026, using account credentials obtained from a third-party source, and that some Chick-fil-A One accounts may have been accessed.

Chick-fil-A One Data Breach Lawsuit: Quick Facts

Detail	Information
Defendant	Chick-fil-A, Inc.
Plaintiff	Brian Williams
Case	Williams v. Chick-fil-A, Inc.
Case number	1:26-cv-04160
Court	U.S. District Court for the Northern District of Georgia
Filed	July 23, 2026
Case type	Putative (proposed) class action; no class certified
Attack dates	June 17 to June 19, 2026
Chick-fil-A customer notice	July 20, 2026
Dismissed	September 1, 2026, voluntarily and without prejudice
Settlement	None
Claim form or payment deadline	None

What Happened in the Chick-fil-A One Data Breach?

Chick-fil-A disclosed the incident in a July 20, 2026 notice to affected customers. The company said it identified suspicious login activity involving certain Chick-fil-A One accounts, and that unauthorized parties launched an automated attack against its website and mobile application between June 17 and June 19.

According to the notice, the attackers used account credentials, including email addresses and passwords, obtained from a third-party source. On July 13, Chick-fil-A determined that unauthorized parties may have accessed information in affected accounts.

This describes credential stuffing: criminals try usernames and passwords stolen elsewhere on accounts where people reused them. Chick-fil-A did not say its own password database was stolen.

What Information Could Have Been Exposed in the Chick-fil-A One Attack?

Chick-fil-A said the information involved varied by account and could have included:

• Name and email address
• Chick-fil-A One membership number
• Mobile pay number and QR code
• Last four digits of a credit or debit card
• Chick-fil-A credit or e-gift-card balance
• Month and day of birth, phone number and address, if saved

Chick-fil-A said it removed stored payment methods from affected accounts, restored affected Chick-fil-A One balances, logged affected accounts out, reset customer passwords and added rewards to affected accounts.

Why Did Brian Williams Sue Chick-fil-A, Inc.?

Williams sued about three days after the company’s customer notice. The docket identifies the filing as a class action complaint with a jury demand, and lists a diversity-based breach-of-fiduciary-duty claim among the causes of action.

Because Williams dismissed the case before any ruling, the complaint’s allegations were not judicially determined to be true.

Was the Williams v. Chick-fil-A Lawsuit a Class Action?

It was filed as a putative class action, meaning a proposed one. The court never certified a class. Chick-fil-A had appeared through counsel and had an extension until September 17, 2026, to answer the complaint, and Williams dismissed the case on September 1, before that deadline.

News of the lawsuit does not mean everyone affected by the Chick-fil-A One incident became a member of a court-approved class.

What Does “Dismissed Without Prejudice” Mean in the Chick-fil-A One Lawsuit?

It ended this lawsuit, but it was not a ruling that Chick-fil-A did nothing wrong, and it was not a settlement. A dismissal without prejudice generally leaves the plaintiff legally able to bring the claim again, subject to applicable law and deadlines. That does not mean another lawsuit will be filed.

Is There a Chick-fil-A One Data Breach Settlement?

No. The federal docket shows a complaint in July and a voluntary dismissal in September, with no settlement, settlement class or payment process. Be cautious about websites or ads saying Chick-fil-A One customers can claim money through Williams v. Chick-fil-A. For how settlement claims work in general, see How To Claim A Lawsuit Settlement?

What Should Chick-fil-A One Customers Do After the 2026 Account Attack?

• Change reused passwords. If your Chick-fil-A password was used on any other site, change it there too.
• Review your Chick-fil-A One account for unfamiliar orders, reward redemptions or account changes.
• Check your payment accounts. Chick-fil-A said stored payment methods were removed from affected accounts, but still review statements for unauthorized charges.
• Report suspicious activity through Chick-fil-A’s customer-support process for fraudulent account or rewards activity.
• Watch for phishing. Do not enter passwords or payment details through an unexpected link claiming to relate to the incident.

Could Another Chick-fil-A Data Breach Lawsuit Be Filed?

Possibly. The September 1 dismissal did not bar a new action by itself, but it does not show that one will be filed. Whether anyone could sue, and on what claims, depends on the facts and applicable law. For now, Williams v. Chick-fil-A is no longer an active federal case: no trial is scheduled, no class certification is pending and no settlement is being administered.

Chick-fil-A One Data Breach Lawsuit: Frequently Asked Questions

Is there a Chick-fil-A One data breach lawsuit?

Yes. Brian Williams filed Williams v. Chick-fil-A, Inc., No. 1:26-cv-04160, in the Northern District of Georgia on July 23, 2026, as a putative class action over the 2026 Chick-fil-A One account incident.

Is the Chick-fil-A One data breach lawsuit still active?

No. Williams voluntarily dismissed it without prejudice on September 1, 2026, and the case was terminated.

Is there a Chick-fil-A data breach settlement?

No. The case was dismissed before any settlement or compensation program was created.

Can I file a claim in the Chick-fil-A data breach case?

No. There is no claim form or settlement process associated with Williams v. Chick-fil-A.

Was the Chick-fil-A lawsuit dismissed with prejudice?

No. It was dismissed without prejudice under Rule 41(a)(1)(A)(i).

Did a court rule that Chick-fil-A was responsible for the data breach?

No. The case ended by voluntary dismissal before any decision on the allegations.

What information was involved in the Chick-fil-A One data breach?

Potentially names, email addresses, membership numbers, mobile pay numbers, QR codes, the last four card digits, Chick-fil-A credit balances and some saved personal details such as phone number, address or birth month and day.

When did the Chick-fil-A One cyberattack happen?

Between June 17 and June 19, 2026, using credentials obtained from a third-party source, according to Chick-fil-A.

Sources and Court Records

• Williams v. Chick-fil-A, Inc., No. 1:26-cv-04160 docket (Justia Dockets)
• Chick-fil-A, Inc. data security notice, July 20, 2026 (Massachusetts Government)
• Chick-fil-A Suspicious Activity FAQ
• Chick-fil-A: How do I report fraudulent account activity?

Disclaimer: For informational purposes only; not legal advice. Allegations in a lawsuit are claims, not findings of fact or liability.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts checked against the federal court docket in Williams v. Chick-fil-A, Inc. (Justia Dockets), Chick-fil-A’s July 20, 2026 customer notice filed with the Massachusetts government and Chick-fil-A’s customer-support pages, as of October 8, 2026. Last Updated: October 8, 2026.