Guac Is Extra: Financial Outlet Sues Chipotle Over March '17 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Bellweather Community Credit Union has filed a proposed class action in Colorado on behalf of credit unions, banks, and other financial institutions for damages that allegedly resulted from a March 2017 data breach that compromised Chipotle customers’ sensitive payment information nationwide. According to the 30-page complaint, the data breach that hit defendant Chipotle Mexican Grill, Inc. forced proposed class members to:

• Cancel or reissue breach-affected credit and debit cards
• Close any deposit, transaction, checking, or other breach-affected accounts
• Open or reopen any deposit, transaction, checking, or other accounts
• Refund or credit cardholders for the cost of any unauthorized transactions related to the breach
• Respond to a “higher volume of cardholder complaints, confusion and concern”
• Bulk up fraud monitoring efforts

Aside from the extra work for financial outlets supposedly directly resulting from the breach, the lawsuit takes issue with Chipotle’s response to the hack, alleging the company “failed to take reasonable steps to employ adequate security measures” that should reasonably have been in place in the wake of other high-profile retail and restaurant data breaches. The case elaborates on one of these now-standard payment card security measures that Chipotle allegedly neglected:

“While Visa implemented minimum EMV Chip Card and Terminal Requirements in October 2015, [Chipotle] has not implemented EMV technology in its stores, and thus left vulnerable to theft all of the information on the magnetic stripe of cards used in its restaurant locations, in a way it has been repeatedly warned about,” the complaint claims.