Here’s a breach that should scare you precisely because it’s boring. Chick-fil-A just disclosed a credential-stuffing attack that drained loyalty accounts — names, emails, mobile-pay numbers, QR codes, account credit. It’s the chain’s second such incident since 2023. And the company insists, correctly, that its own systems and password database were never breached.

Read that again. The company wasn’t hacked. You were — somewhere else, a while ago — and the attackers just tried your old password on a new site. That’s credential stuffing: take username/password pairs leaked from Breach A, spray them at Sites B through Z, and cash in wherever someone reused a password. With 149 million passwords sitting in one open infostealer database this year, attackers have effectively unlimited ammunition.

The good news: this is one of the most fixable problems in all of security. Let’s fix it, in three steps, this afternoon.

Step 1: Find Out What’s Already Leaked

You can’t defend what you don’t know is exposed. The gold standard is Have I Been Pwned (HIBP), which tracks billions of leaked credentials. Two ways to use it:

The easy way: go to haveibeenpwned.com, enter your email, and see which breaches you’re in. Do this for every email you use.

The noob-leveling-up way: check whether a specific password has leaked — without ever sending the password anywhere. HIBP uses k-anonymity: you send only the first 5 characters of your password’s SHA-1 hash, and the API returns every leaked hash starting with those 5 characters. Your machine does the final match locally. The password never leaves your laptop.

#!/usr/bin/env bash
# pwned-check.sh — check a password against HIBP without sending it anywhere
read -rsp "Password to check (hidden): " pw; echo
hash=$(printf '%s' "$pw" | sha1sum | tr 'a-f' 'A-F' | cut -d' ' -f1)
prefix=${hash:0:5}    # first 5 chars — the ONLY thing that leaves your machine
suffix=${hash:5}      # everything else — stays local
count=$(curl -s "https://api.pwnedpasswords.com/range/$prefix" | tr -d '\r' \
        | grep -i "^$suffix:" | cut -d: -f2)
if [ -n "$count" ]; then
  echo "⚠️  Seen $count times in breaches. Change it everywhere it's used."
else
  echo "✅ Not found in HIBP's dataset. (Not proof it's safe — just not leaked yet.)"
fi

Run bash pwned-check.sh and test a password you actually use. If it comes back with a count, that password is on attackers’ lists right now — and any account reusing it is a stuffing target.

Step 2: Make Every Password Unique (Password Manager)

Credential stuffing only works because of reuse. Break reuse and you break the entire attack class — a password stolen from one site becomes worthless everywhere else. The only realistic way to have a different strong password for hundreds of sites is a password manager. This is old advice, but the reasons to use one keep getting more expensive to ignore.

Your migration plan:

  1. Pick a manager. Bitwarden (open-source, free tier), 1Password, or KeePassXC if you want fully offline and local. Any of them beats reuse.
  2. Set a strong master passphrase. Four or five random words you’ll actually remember beats a gnarly 12-character string. This one password protects all the others — make it unique and never type it into anything but the manager.
  3. Import, then triage. Import your browser-saved passwords, then run the manager’s built-in breach/reuse report. It will flag every reused and leaked password. Fix the reused ones on your important accounts first: email, bank, primary cloud.
  4. Let it generate from now on. Every new signup gets a unique 20+ character random password you never see or type.

Prioritize your email account above everything. Email is the master key — password resets for every other account land there. If an attacker owns your email, unique passwords elsewhere won’t save you.

Step 3: Go Passwordless Where You Can (Passkeys + FIDO2)

Unique passwords stop stuffing. But passwords can still be phished, keylogged, or scraped from an infostealer. The structural fix is to stop having a shared secret at all. That’s what passkeys do.

A passkey is a public/private key pair bound to a specific website. The private key never leaves your device; the site only ever stores the public key. There’s nothing to reuse, nothing to stuff, and nothing worth stealing from the site’s database. Phishing largely dies too, because the passkey is cryptographically tied to the real domain — a lookalike login page simply can’t use it.

How to start:

  • Turn on passkeys for your big accounts today. Google, Apple, Microsoft, GitHub, and most major services support them. Look for “Passkeys” or “Security keys” in account security settings and enroll.
  • Store them in your password manager or platform. Bitwarden, 1Password, iCloud Keychain, and Google Password Manager all sync passkeys across your devices.
  • For the accounts that matter most, use a hardware key. A physical FIDO2 key like a Nitrokey or YubiKey holds the private key in dedicated hardware that a remote attacker can’t reach at all — the same open-source hardware key that anchors the homelab trust stack we covered recently. US buyers can grab one at securitygadgets.shop/nitrokey. Enroll two so you have a backup.

Ditch SMS 2FA While You’re Here

If a service doesn’t offer passkeys yet, still turn on two-factor — but avoid SMS codes where you can. Texted codes can be SIM-swapped or, increasingly, relayed by reverse-proxy phishing kits in real time. Prefer, in order: a hardware key → an authenticator app (TOTP) → SMS only as a last resort. Any second factor beats none; a phish-resistant one beats a code you can be tricked into reading aloud.

Your 30-Minute Action Plan

You don’t have to do everything at once. Do this much today and you’ve moved out of the credential-stuffing target pool:

  • Check your main emails on haveibeenpwned.com.
  • Run pwned-check.sh against your 3 most-used passwords.
  • Install a password manager and set a strong master passphrase.
  • Change the password on your email account to a unique generated one.
  • Turn on a passkey or hardware-key 2FA for email + one bank/cloud account.
  • Fix every reused password the manager flags, worst offenders first.

The Bottom Line

Chick-fil-A did not get its password database stolen, and its customers still got their accounts drained. That’s the whole point of credential stuffing — the breach that burns you already happened somewhere else, and the only thing that saves you is not reusing what leaked. Unique passwords make stuffing fail. Passkeys make the whole category of attack structurally impossible. Both are free, both are same-day, and there’s no reason to still be a target next week.

Affiliate disclosure: the Nitrokey links above are affiliate links. If you buy through them we may earn a commission at no extra cost to you — and we only recommend hardware we’d hand to a noob ourselves.