Between June 17 and 19, 2026, attackers ran an automated credential stuffing attack against Chick-fil-A One loyalty accounts on the company’s website and mobile app. They used stolen email and password pairs, affecting thousands of customers.
Customer accounts were taken over twice in under four years. Between December 2022 and February 2023, a similar wave of credential stuffing attacks exposed personal information and drained rewards balances in more than 71,000 Chick-fil-A customer accounts. A brand as big as Chick-fil-A can survive that. A smaller company may not.
Customer accounts are a common target for credential stuffing attacks. Password reuse is widespread among consumers, and the accounts hold saved payment methods, loyalty points, addresses and order histories. Accounts confirmed to work can also be resold. Yet many companies still give customer accounts less scrutiny than they give employee accounts.
That is why the CIAM vs IAM distinction matters in cases where customers are involved. Customer accounts need tools built for the job, not workforce IAM applied to customers.
Why Customer Accounts Are Different
IAM and CIAM solve different problems because they manage different people. IAM manages a known, limited workforce. Employees sign in on managed devices. The company sets password rules and decides when MFA is required. IT can enforce policy, push updates and cut off access the day someone leaves.
CIAM manages millions of self-registered users the company doesn’t control. Customers sign up on their own and log in from any device. The company can’t manage those devices or dictate how people handle their credentials. Many customers reuse passwords from other sites, including sites that have already been breached.
That was Chick-fil-A’s position. It had no control over where its customers might have used the same email and password before. In short, IAM protects people the company manages. CIAM protects people the company serves.
Why Workforce Defenses Don’t Carry Over
Security teams know how to lock down employee logins. But if they try to apply those same controls to customers, they will certainly face backlash, and a whole lot of support tickets.
Let’s take hardware keys as an example. A company can hand one to every employee. But it can’t hand one to every customer, and customers won’t buy one just to check a loyalty balance. They’ll order from a competitor instead. Requiring managed devices makes even less sense.
Even a common control like a strict lockout policy can backfire. An attacker can fail logins on purpose. A few wrong guesses lock the account, and the real customer can’t get in. In an orchestrated attack across thousands of accounts, that adds up to a lot of unhappy customers. Depending on the setup, the support queue can also fill with reset requests.
Workforce controls rely on compliance. An employee who finds MFA annoying still has to use it to do their job. A customer who finds it annoying can just shop somewhere else.
Customer Identity and Access Management is the solution that covers what workforce IAM can’t. It approaches account security from a different angle, one that assumes the company doesn’t have full control over the user and builds defenses around that. With customer accounts, that is certainly the case.
CIAM starts with the problem of scale, specifically dealing with bots flooding public login pages. CIAM solutions can apply rate limits to logins from the same IP, device and account, so a script can’t keep trying stolen pairs at full speed. Traffic that still looks automated may be confronted with a challenge, such as a CAPTCHA or a background puzzle, before it reaches the login form.
Increasingly, CIAM solutions are also pushing passwordless authentication. With passkeys, the private key stays on the customer’s device and unlocks with a fingerprint or face scan. The company stores only the public key, so there is no password to reuse or replay. It isn’t a cure-all, since password fallbacks and account recovery can still be attacked. But it is a significant step, and more and more companies have started adopting it.
Not every customer will move away from passwords right away, so MFA still plays a role. CIAM solutions use adaptive MFA, which scores each login by device, location and speed. A known device on a normal network passes straight through. An unknown device in a new country is asked for a second factor.
If a compromise still succeeds after all these checks, behavioral analytics and real-time monitoring step in. Patterns like many accounts tried from one device, or an immediate jump to stored payment methods, can trigger a forced re-login or a block on sensitive actions.
Chick-fil-A’s story is a reminder that customer accounts don’t fail the way employee accounts do. Attackers didn’t break into Chick-fil-A’s systems or trick its staff. They had a list of stolen logins and a script.
That is what makes credential stuffing hard to stop with workforce thinking. IAM works because the company controls the people, the devices and the rules. Customers offer none of that. They sign up on their own, log in from anywhere and leave when the experience gets in the way.
Customer identity needs tools built for its scale, threat model and user experience. Once companies stop treating customers like employees, stolen logins will be rendered far less valuable to attackers.
