Your Chicken Sandwich Account Got Hacked 🍗 — And Why MFA Isn't Saving You 🔐

Two stories this week are a reminder that your password isn't the only thing standing between you and a hacker — and sometimes even your extra security codes can be turned against you. Here's what happened, and why it matters for you and your business.

🍗 Hackers Ordered Up a Side of Your Data at Chick-fil-A

Chick-fil-A confirmed that attackers broke into customer accounts on its website and app over a three-day stretch in June. They didn't hack the company directly — instead they used a trick called "credential stuffing," where criminals take usernames and passwords stolen from other breaches and try them en masse, betting that lots of people reuse the same login everywhere.

It worked. The exposed information includes names, contact details, membership and payment info, and partial card numbers for Chick-fil-A One accounts across several U.S. states. The company has reset logins, wiped stored payment methods, and restored account balances — but the real lesson is simple: if you reuse passwords, one old breach can unlock all your accounts. Use a unique password for every site (a password manager makes this painless) and turn on two-factor authentication wherever you can.

Read more

🔐 The Phishing Scam That Strolls Right Past Two-Factor Login

Think two-factor authentication (that extra code you punch in) makes you untouchable? A fast-growing attack called "device code phishing" is proving otherwise. It abuses a legitimate Microsoft feature — the one that lets you sign a TV or printer into your account using a short code — by tricking you into typing an attacker's code into the real Microsoft login page. Because everything looks genuine, you hand over full access without your password ever being stolen or your MFA ever being "broken."

Ready-made kits with AI-written lure emails are now being sold to criminals, and campaigns have already hit hundreds of Microsoft 365 business accounts worldwide — often to reroute invoices and payments to the attackers. The takeaway for any company: treat any unsolicited login code as an attack, never enter a code you didn't personally request, and have your IT team block the device-code login flow if you don't need it.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.