❗Article Status Notice: This Article is a stub
This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼
Founded in 1993 by Steve Ells, Chipotle Mexican Grill, Inc. (also referred as Chipotle) is an American chain of fast casual restaurants primary serving burritos and bowls across over 4000 locations globally.
| Basic information | |
|---|---|
| Founded | 1993-07-13 |
| Legal Structure | Public |
| Industry | Food |
| Also known as | |
| Official website | http://chipotle.com/ |
Consumer-impact summary
Incidents
This is a list of all consumer-protection incidents this company is involved in. Any incidents not mentioned here can be found in the Chipotle category.
Data Breach (2004)
Around 2004, Hackers gained access to Chipotle payment systems, stealing customers data labelled as "Track 2" that contained customers name, card number, card expiration date, and card verification number. Chipotle found out about the attack in August after their merchant bank informed the company of the attack. Although specific details aren't publicized, through fillings with the Securities Exchange Commission:, the company lost an estimate $4.3 million in revenue starting 2004 through 2006.[1]
Misleading Advertisement regarding contents of Calories in products (2016)
In November, three customers filed a lawsuit against Chipotle for falsely advertising the quantity of calories contained in various products after eating a Chorizo Burrito that indicated the product will contain 300 calories with an in-store sign, however the actual contents amounted to over 1000 calories.[2] Chipotle responded via a tweet on twitter (now formarly X) saying; "I'm sorry for the confusion, but we'll make things more clear next time. The 300 calories is for the chorizo."[3] The lawsuit reached a settlement in October 2017 that resulted in Chipotle changing their signs to display correct calories contents and rewarding the plaintiffs $5000.[4]
Chipotle Used Customers Faces without their consent (2017)
In January, Leah Caldwell filed a lawsuit against Chipotle for unlawful advertisement and marketing of her photo, seeking over $2.2 billion in damages.[5] In 2006, Leah Caldwell sat in a Chitpotle restaurant when photographer Steve Adams took a photo of her while eating. Before leaving, Steve Adams asked her to sign the sign a release form, however she declined.[6] 8 years later around December, she discovered her photo was used as promotion Florida and Califronian chipotle restaurant up till 2015.[7][8] The Lawsuit reached a settlement in 2017, however specific details surrounding the agreement remain unknown.[4]
Data Breach (2017)
Between March 24 to April 18, hackers were able to infiltrate Chipotle point of sale systems through a malware attack, affecting over 2,250 locations globally and resulting in some customers name, card number, expiration date, and verification code information being stolen. On April 25, Chipotle disclosed and started an investigation into the incident. Additionally The company claimed no other information was collected.[9]
“During the investigation we removed the malware, and we continue to work with cyber security firms to evaluate ways to enhance our security measures,” the company says. “In addition, we continue to support law enforcement”s investigation and are working with the payment card networks so that the banks that issue payment cards can be made aware and initiate heightened monitoring.”[10]
This resulted in a lawsuit being filed against Chipotle on May 4 for failure to conduct adequate security measures and prevent future breaches.[1] A settlement was reached in 2019, compensating customers affected between March 24 and April 18 $250 or $10000.[11]
Data Breach (2019)
Around April, people posted on Reddit and X (Formally Twitter) of their accounts being used to order food across different locations.[12] A spokesperson at Chipotle responded by saying the attack was due to credential stuffing, however several customers claimed to have unique passwords specific to Chipotle.[13] The exact amount of customers affect, along with specific dates towards fixing the vulnerability and names of perpetrators, remains unknown.
Sending Automated Spam Messages To customers without Consent
2017 Incident
On December 21, Richard Rabinowitz filed a class action lawsuit against Chipotle for allegedly violating the Telephone Consumer Protection Act by sending customers marketing messages without consent through their automatic telephone dialing system. Around November 17 through December 18, Richard Rabinowitz received 5 messages marketing the newly released Queso, however the plaintiff claims it was targeted marketing as the Queso wasn't positively received by customers. [14] As of March 2026, the lawsuit is still progressing in courts.
2019 Incident
On June 19, a lawsuit was filed against Chipotle for allegedly sending customers marketing messages without consent using an automatic dialer for promotion of their products. As of March 2026, the case is still ongoing.[15]
2023 Incidents
On January 18, Sandra Diaz filed a lawsuit against Chipotle after receiving marketed messages on October 31 without given consent. The plaintiff alleges the company sent messages to customers using an automatic dialing system, dating to early July 2021.[1] As of March 2026, the lawsuit is still in progress.
False Advertising on non-GMO food (2019)
Overcharging Customers Using the App (2019)
Chipotle Restaurants Not Accommodating Disabled Individuals (2021-2022)
Chipotle was involved in a lawsuit, alleging failure to provide access towards disabled customers with wheel chairs due to lack of feet comfort in tables and chairs. The case was dismissed in 2022.[16]
AI-voice ordering systems unlawfully collected Customers Data (2022)
Charging Customers Extra with hidden Fee's (2021 and 2024)
Refusing any Refunds made with Gift Card purchases (2024)
https://www.classaction.org/news/chipotle-gift-card-refunds-lawsuit-says-meal-vouchers-are-worthless
Chipotle Quietly lessen Food Quantity
This section is incomplete. This notice can be deleted once all the placeholder text has been replaced.
https://www.the-sun.com/money/12792714/chipotle-ceo-change-orders-diners-threatened-boycott/
Health Violations
This section is incomplete. This notice can be deleted once all the placeholder text has been replaced.
2008 Hepatitis Outbreak
2008 Norovirus Outbreak
2015 E.Coli
2015 Norovirus
In 2020 Chipotle agreed to pay 25 million dollar fine and a three year deferred prosecution agreement related to the foodborne illness outbreaks that sickened more than 1,100 people between 2015 and 2018.[17]
2015 Salmonella
2015 E.Coli (October)
2015 Norovirus (december 15)
2017 Norovirus
2018 Clostridium perfringens
https://www.foodpoisoningnews.com/food-poisoning-at-chipotle-a-history-of-food-safety-issues/
https://www.foodpoisoningnews.com/food-poisoning-at-chipotle-a-history-of-food-safety-issues/
https://archive.cdc.gov/#/details?url=https://www.cdc.gov/ecoli/2015/o26-11-15/index.html
https://www.wcpo.com/lifestyle/food/chipotle-e-coli-outbreak-spreads-to-akron-store
https://www.wral.com/story/cause-of-ohio-chipotle-outbreak-identified/17773868/
https://www.devicedaily.com/pin/chipotle-eats-itself/
Chipotle Bowls Contain Cancer related Chemicals (2019-2020)
https://www.mashed.com/250704/scandals-chipotle-can-never-live-down/
Bugs Found inside Customers Products (2024)
https://digitalchew.com/2025/12/10/chipotle-lawsuit-woman-claims-rodent-in-burrito/
See also
References
- ↑ 1.0 1.1 1.2 Rizzi, Corrado (4 May 2017). "Guac Is Extra: Financial Outlet Sues Chipotle Over March '17 Data Breach". ClassAction. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ McNeal, Stephanie (22 November 2016). "People Are Furious With Chipotle Because They Thought A Burrito Was 300 Calories". BuzzFeed News. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "Chipotle sued over misleading '300-Calorie' burrit". ABC13. 24 November 2016. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ 4.0 4.1 Smith, Jacob (31 October 2024). "13 Shady Things You Can't Ignore About Chipotle". TheTakeout. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "Using a Person's Image for Commercial Purposes: Lessons Learned from the Chipotle $2.2 Billion Lawsuit". TarterKrinsky & Drogin. 25 January 2017. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ Pham, Peter (6 January 2017). "Chipotle Faces $2 Billion Lawsuit For Allegedly Using Photo Of Woman Without Permission". FoodBeast. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ Hillen, Brittany (9 January 2017). "Chipotle sued for $2.2b for allegedly using woman's photo without permission". DPreview. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "A Woman Is Suing Chipotle For $2.2 Billion". HnHH. 22 November 2022. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "CHIPOTLE MEXICAN GRILL REPORTS FINDINGS FROM INVESTIGATION OF PAYMENT CARD SECURITY INCIDENT" (PDF). Chipotle — Security Inciden. 26 May 2017. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ TRUȚĂ, Filip (30 May 2017). "Chipotle customers told to 'remain vigilant' as POS hack probe reveals most restaurants affected". Bitdefender. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "Chipotle Data Breach Class Action Settlement". Top Class Action. 23 July 2019. Retrieved 14 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "DATA BREACH AT CHIPOTLE FAST FOOD RESTAURANT, DOZENS OF APP ACCOUNTS WERE HACKED". International Institute of Cyber Security. 24 April 2019. Retrieved 14 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ Whittaker, Zack (17 April 2019). "Chipotle customers are saying their accounts have been hacked". Techrunch. Retrieved 14 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ Rizzi, Corrado (10 January 2018). "Florida Man Files Class Action Against Chipotle Over Alleged Unsolicited Text Messages". ClassAction. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ Rizzi, Corrado (19 July 2019). "Chipotle Hit with TCPA Class Action Over Alleged Automated Text Messages". ClassAction. Retrieved 13 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ White, Brian (16 February 2021). "Chipotle, Takao, Baby Blues-Bar-B-Q Chains Accused in ADA Lawsuits". Top Class Action. Retrieved 14 March 2026.
{{cite web}}: CS1 maint: url-status (link) - ↑ "Office of Public Affairs". justice.gov. 2020-04-21.