Second Chipotle Class Action Lawsuit Filed Over Data Breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Chipotle Mexican Grill Inc. was hit with another class action over a 2017 data breach that allegedly exposed customer debit and credit card information.

Chipotle customers Greg Lawson and Judy Conard filed this class action lawsuit alleging the Mexican-style food chain failed to adequately protect their personally identifiable information.

Further, say the plaintiffs, Chipotle failed to adequately inform affected consumers and let them know what information had been exposed in the data breach.

“Chipotle could have and should have prevented this Data Breach,” alleges the Chipotle class action lawsuit. “Data breaches at other retail and restaurant establishments in the last few years have been the result of malware installed on [payment] systems. While many retailers, restaurants, banks, and other companies have responded to recent breaches by adopting technology that helps make transactions more secure, Chipotle did not.”

The plaintiffs each allege that after using their debit cards at Chipotle restaurants, they received notifications that their cards had been compromised. They say they both had to cancel and receive reissued cards. Conard alleges that she purchased Lifelock as a result of her information being stolen from Chipotle during the breach.

This is the second class action to hit the popular chain after hackers targeted the restaurant’s payment system to steal sensitive personal information in March of this year. According to the class actions, the malware installed by the hackers stole customer information from March 24 to April 25, 2017.

According to the class action, this is the second data breach Chipotle has reported. In 2004, the restaurant revealed that its credit and debit card payment systems had been vulnerable since they began accepting card payments in 2009. The plaintiffs argue that Chipotle should have known of the danger of data breaches and worked to protect customer information.

“It is well-known and the subject of many media reports that [private identifiable information] data is highly coveted and a frequent target of hackers,” alleges the complaint. “Despite the frequent public announcements of data breaches by retailers, Chipotle maintained an insufficient and inadequate system to protect the PII of Plaintiffs and putative class members.”

The plaintiffs in this Chipotle class action lawsuit note that after discovering the breach, Chipotle posted a notice on its website. “According to publicly available information, the Data Breach affected ‘most’ Chipotle restaurants and Pizzeria Locale restaurants, also owned and operated by Chipotle, located in all 48 contiguous states in the United States.”

The plaintiffs seek to represent a nationwide Class of Chipotle customers for claims of fraud, negligence and violation of state consumer laws.

The plaintiffs are seeking damages as well as a court order forcing Chipotle to “issue prompt, complete and accurate disclosures” of the data breach to the proposed Class.

The class action plaintiffs are represented by Kevin S. Hannon of The Hannon Law Firm LLC, John Yanchunis and Marisa Glassman of the Morgan & Morgan Complex Litigation Group, Ben Barnow, Erich Schork and Anthony L. Parkhill of Barnow and Associates PC, Jean Sutton Martin of the Law Office of Jean Sutton Martin PLLC, Christopher D. Jennings of Johnson Vines PLLC, Paul Whalen of the Law Office of Paul C. Whalen PC, Jasper D. Ward IV of Jones Ward PLC, and Brian P. Murray of Glancy Prongay & Murray LLP.

The Chipotle Data Breach Class Action Lawsuit is Greg Lawson, et al. v. Chipotle Mexican Grill Inc., Case No. 1:17-cv-01997-CBS, in the U.S. District Court for the District of Colorado.