Chipotle says hackers stole payment card info in data breach

May 26 (Reuters) - Chipotle Mexican Grill Inc said on Friday hackers used malware to steal customers' card data, including account number, expiration date and internal verification codes, from payment systems at some of its restaurants over a span of three weeks.

Chipotle, which is fighting to recover from 2015 food safety lapses that pummeled its sales, said it did not know how many payment cards had been affected but said the malware has since been removed.

The information could be used to drain bank accounts, if a debit card was used, or to make credit card purchases, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

21 PHOTOS
Chipotle restaurants through the years
See Gallery
Chipotle restaurants through the years
DENVER, CO - FEBRUARY 9: Steve Ells, 32, owner of the Chipotle Mexican Grill restaurant chain, in front of one of his stores at 32nd & Lowell Blvd. in Denver, Colorado on Monday, Feb. 9, 1998. (Photo by Hyoung Chang/The Denver Post via Getty Images)
Exterior of the Chipotle restaurant on Wisconsin Ave. NW Washington, D.C. (Photo by Michael Williamson/The Washington Post/Getty Images)
GLENVIEW, IL - DECEMBER 02: Activity is seen near the order-counter area inside a Chipotle restaurant December 2, 2005 in Glenview, Illinois. McDonald's Corp., owners of 92 percent of Chipotle, are preparing its Mexican-style eateries for an initial public offering. (Photo by Tim Boyle/Getty Images)
CHICAGO - JANUARY 26: The Chipoltle Mexican Grill logo is painted on the door of one of the Chain's restaurants in the trendy Bucktown neighborhood January 26, 2006 in Chicago, Illinois. McDonald's spin-off of the restaurant chain ended the day with the Initial Public Offering (IPO) closing at $44, double its opening price. It was the best opening day gain by a U.S.-based IPO in more than five years. (Photo by Scott Olson/Getty Images)
UNITED STATES - JANUARY 26: Workers prepares meals at Chipotle Mexican Grill in West Bloomfield, Michigan on Thursday, January 26, 2006. Chipotle Mexican Grill Inc.'s shares more than doubled on the first day of trading after McDonald's Corp. took the fast-growing chain public. (Photo by Jeff Kowalsky/Bloomberg via Getty Images)
DENVER, CO - JANUARY 26: The original Chipotle restaurant at 1644 E. Evans Ave in Denver, shown here on Jauary 26, 2006. (Photo by Cyrus McCrimmon/The Denver Post via Getty Images)
A Chipotle burrito in it's signature aluminum wrap on Friday, February 12, 2010. Burrito was that the original location on E. Evans Ave. Cyrus McCrimmon, The Denver Post (Photo By Cyrus McCrimmon/The Denver Post via Getty Images)
Chipotle burritos at the original location on E. Evans Ave. Bryan Sawyer who eats about 3 times a week at the Chipotle eats a steak black bean burrito on Friday, February 12, 2010. Cyrus McCrimmon, The Denver Post (Photo By Cyrus McCrimmon/The Denver Post via Getty Images)
Gregory Rec/Staff Photographer: -- Kyle Braley stirs a tomatillo green chili salsa at Chipotle Mexican Grill in South Portland on Monday, December 13, 2010. The popular restaurant chain, which serves naturally-raised beef, chicken and pork, has its grand opening today. (Photo by Gregory Rec/Portland Press Herald via Getty Images)
A pedestrian walks into a Chipotle Mexican Grill Inc. location in New York, U.S., on Wednesday, Oct. 17, 2012. Chipotle, the best- performing restaurant stock in the Standard & Poor's 500 Index last year, is expected to release earnings data on Oct. 18. Photographer: Scott Eells/Bloomberg via Getty Images
The Chipotle Mexican Grill Inc. logo is displayed on a paper bag at a location in New York, U.S., on Wednesday, Oct. 17, 2012. Chipotle, the best- performing restaurant stock in the Standard & Poor's 500 Index last year, is expected to release earnings data on Oct. 18. Photographer: Scott Eells/Bloomberg via Getty Images
Chipotle Mexican Grill Inc. employees prepare food at a location in New York, U.S., on Wednesday, Oct. 17, 2012. Chipotle, the best- performing restaurant stock in the Standard & Poor's 500 Index last year, is expected to release earnings data on Oct. 18. Photographer: Scott Eells/Bloomberg via Getty Images
A steak burrito is arranged for a photograph with a drink and bags of chips at a Chipotle Mexican Grill Inc. restaurant in Hollywood, California, U.S., on Tuesday, July 16, 2013. Chipotle Mexican Grill Inc. is scheduled to release earnings data on July 18. Photographer: Patrick T. Fallon/Bloomberg via Getty Images
A employee sprinkles cheese on a burrito at a Chipotle Mexican Grill Inc. restaurant in Hollywood, California, U.S., on Tuesday, July 16, 2013. Chipotle Mexican Grill Inc. is scheduled to release earnings data on July 18. Photographer: Patrick T. Fallon/Bloomberg via Getty Images
Employees prepare lunch orders at a Chipotle Mexican Grill restaurant at Madison Square Park in New York, U.S., on Wednesday, Jan. 29, 2014. Chipotle Mexican Grill Inc. is expected to release earnings figures on Jan. 30. Photographer: Craig Warga/Bloomberg via Getty Images
Employees prepare lunch orders at a Chipotle Mexican Grill restaurant at Madison Square Park in New York, U.S., on Wednesday, Jan. 29, 2014. Chipotle Mexican Grill Inc. is expected to release earnings figures on Jan. 30. Photographer: Craig Warga/Bloomberg via Getty Images
MIAMI, FL - MARCH 05: A Chipotle restaurant is seen on March 5, 2014 in Miami, Florida. The Mexican fast food chain is reported to have tossed around the idea that it would temporarily suspend sales of guacamole due to an increase in food costs. (Photo by Joe Raedle/Getty Images)
A Chipotle eatery in the Financial District of Manhattan NYC viewed from the outside looking in shows the interior design as well as people eating & talking, & also reflects the urban building from across the street in the upper left corner of the window
NEW YORK CITY, NEW YORK, UNITED STATES - 2015/10/18: Restaurants in USA: Chipotle Mexican Grill Chipotle Mexican Grill, Inc. is a chain of restaurants in the United States, United Kingdom, Canada, Germany, and France, specializing in Mission burritos and tacos. (Photo by Roberto Machado Noa/LightRocket via Getty Images)
NEW YORK, NEW YORK -- FEBRUARY 8: A sign sits in the window of a Chipotle restaurant on Broadway in Lower Manhattan telling customers the restaurant is closed until 3 p.m. on February 8, 2016 in New York City. The Mexican food chain is closing stores for lunch nationwide for a meeting on food safety following a number of E. coli outbreaks. (Photo by Andrew Renneisen/Getty Images)
HIDE CAPTION
SHOW CAPTION
of
SEE ALL
BACK TO SLIDE

An investigation into the breach found the malware searched for track data from the magnetic stripe of payment cards.

Most of Chipotle's U.S. restaurants may have been affected by the breach for varying amounts of time between March 24 and April 18, spokesman Chris Arnold said via email.

Chipotle, which operates 2,249 U.S. restaurants, is not offering credit monitoring or notifying affected customers directly, as many other chains have in the past.

"Credit monitoring is only designed to let you know when someone is opening a new credit account using your information. Credit monitoring does not alert you when a fraudulent charge is made on a payment card," Arnold said.

He also noted that Chipotle could not alert customers directly as it did not collect their names and mailing addresses at the time of purchase.

The company said it had posted a notification on the Chipotle and Pizzeria Locale websites and issued a press release to make guests aware of the incident.

Linn Freedman, an attorney at Robinson & Cole LLP specializing in data breaches, said Chipotle was putting the burden on the consumer to discover possible fraudulent transactions by notifying them through the websites.

Shares in Chipotle Mexican Grill ended marginally lower at $480.15 on Friday.

(Reporting by Natalie Grover and Siddharth Cavale in Bengaluru and Lisa Baertlein in Los Angeles; Editing by Grant McCool and Sai Sachin Ravikumar)

Read Full Story

Can't get enough business news?

Sign up for Finance Report by AOL and get everything from retailer news to the latest IPOs delivered directly to your inbox daily!

Subscribe to our other newsletters

Emails may offer personalized content or ads. Learn more. You may unsubscribe any time.