Credential Stuffing Shows Why CIAM and IAM Aren’t Interchangeable - Cybersecurity Insiders

Between June 17 and 19, 2026, attackers ran an automated credential stuffing attack against Chick-fil-A One loyalty accounts on the company's website and mobile app. They used stolen email and password pairs, affecting thousands of customers. This marks the second major credential stuffing attack against the fast-food chain in under four years.

Between December 2022 and February 2023, a similar wave of credential stuffing attacks exposed personal information and drained rewards balances in more than 71,000 Chick-fil-A customer accounts. While a brand as large as Chick-fil-A can survive such incidents, smaller companies might not.

Customer accounts have become prime targets for credential stuffing attacks because they contain saved payment methods, loyalty points, addresses, and order histories. Accounts confirmed to work can also be resold on underground markets. Despite this risk, many companies still give customer accounts less security scrutiny than employee accounts.

Customer Accounts Are Different

IAM and CIAM solve different problems because they manage different types of users. IAM manages a known, limited workforce where employees sign in on managed devices, and the company sets password rules and decides when multi-factor authentication (MFA) is required. IT can enforce policy and cut off access when someone leaves the organization.

CIAM, on the other hand, manages millions of self-registered users that the company doesn't control. Customers sign up on their own and log in from any device. The company can't manage those devices or dictate how customers handle their credentials. Many customers reuse passwords from other sites, including those that have already been breached.

As Chick-fil-A discovered, they had no control over where their customers might have used the same email and password before. In short, IAM protects people the company manages, while CIAM protects people the company serves.

Workforce Defenses Don't Work

Security teams know how to lock down employee logins, but applying those same controls to customers would likely cause backlash and a flood of support tickets. For example, a company can hand hardware keys to every employee, but it can't do the same for customers, who won't purchase just to check a loyalty balance.

Even common controls like strict lockout policies can backfire. Attackers can intentionally fail logins, locking accounts and preventing real customers from accessing them. In an orchestrated attack across thousands of accounts, this creates many unhappy customers and fills support queues with reset requests.

Workforce controls rely on compliance. An employee who finds MFA annoying still has to use it to do their job. A customer who finds it annoying can simply shop elsewhere.

CIAM Solutions

Customer Identity and Access Management approaches account security from a different angle, assuming the company doesn't have full control over the user. CIAM starts with the problem of scale, specifically dealing with bots flooding public login pages. CIAM solutions can apply rate limits to logins from the same IP, device, and account.

Traffic that still looks automated may be confronted with challenges like CAPTCHAs before reaching the login form. Increasingly, CIAM solutions are also pushing passwordless authentication. With passkeys, the private key stays on the customer's device and unlocks with a fingerprint or face scan. The company stores only the public key, eliminating passwords to reuse or replay.

Not every customer will abandon passwords immediately, so MFA still plays a role. CIAM solutions use adaptive MFA, which scores each login by device, location, and speed. A known device on a normal network passes through, while an unknown device in a new country triggers a second factor. If a compromise occurs, behavioral analytics and real-time monitoring can detect patterns like multiple accounts accessed from one device and trigger forced re-logins or blocks on sensitive actions.

The Takeaway

Chick-fil-A's story demonstrates that customer accounts don't fail the way employee accounts do. Attackers didn't break into Chick-fil-A's systems or trick its staff—they had a list of stolen logins and a script. This makes credential stuffing difficult to stop with workforce thinking, which relies on controlling people, devices, and rules.

Customer identity requires tools built for its scale, threat model, and user experience. Once companies stop treating customers like employees, stolen logins will become far less valuable to attackers.