Chipotle Breach Gives Burrito Lovers Another Unappetizing Incident

Burrito lovers just can’t catch a break. The restaurant chain, Chipotle Mexican Grill has once again made the news for another un-tasty event. This time, it has nothing to do with food quality, however. It announced this week that those who visited its restaurants for approximately a three-week period may have had their payment card information stolen by hackers.

A notice on the company’s website disclosed that there was “unauthorized activity on the network that supports payment processing for purchases” made at their restaurant locations between March 24 and April 18 of this year.

Anyone who used payment cards at Chipotle during that timeframe should check their statements and charges for any suspicious activity. If something looks amiss, it should be reported to the card issuer immediately. Watch for these unauthorized charges for at least the next year or until the card expires or is no longer valid.

Chipotle is one of the businesses that reportedly had no plans to switch to the EMV (EuroPay, MasterCard, and Visa) system due to the additional time it takes to process payments. According to some statistics, it can take 10-20 seconds longer. It’s not alone. As of September 2015, 21% of small businesses had also made the same decision according to a survey by Wells Fargo/Gallup.

There is no law stating that the chip-and-pin (or in the case of the U.S., chip-and-signature) systems must be installed. However, the information is more difficult to steal than what is stored on the magnetic strips of cards. The cards are also more difficult to duplicate. Therefore, an organization that does accept them is less of a target and more secure than one that does not.

The downside of EMV chips, especially in incidents like this, is that they do nothing for online fraud. It’s true that it is far more difficult for criminals to physically duplicate your card with the stolen information, but they can use the information to shop online until the credit card number is shutdown; and that does not happen as quickly as one might think. This breach occurred last month, giving the criminals almost 6 weeks to sell the card information to would-be shoppers. Because of this, it would be a great idea to go back through your statements and check for anything out of the ordinary just to be safe.

Chipotle is still investigating the incident and does not have any numbers available as far as how many people may have been affected. However, the chain has over 2,000 restaurants so that number may turn out to be in the millions when all is said and done.

According to the notice on the website, those affected will be notified once the investigation is far enough along and those customers are identified.

Whether or not the network is free of malware or the intruders have been blocked, the notice states, “We believe actions we have taken have stopped the unauthorized activity, and we have implemented additional security enhancements.”