The Last Thing Chipotle Needed Just Happened

Remember when we were talking about technology being the key to Chipotle’s ultimate comeback after the food safety disasters of 2015? You remember, the ones including salmonella, E.Coli and norovirus incidents? Yeah, those. It seemed for a while like Chipotle was about to come back, thanks to new, convenient technologies like an emphasis on mobile ordering and mobile payments.

Those aspirations may now be dead as Chipotle has recently suffered a major data breach at 2,250 of its locations

Interestingly, the market didn’t seem to be terribly put out by this, and shares of Chipotle are down around $475 as of this writing. Shares were around $480 back on Friday of last week, so impact appears mild at best. Given that shares were close to the $500 mark just two weeks ago, however, it can be said that the news had some market impact.

The impact of the data breach—said to be linked to unexpected malware in the system—landed not only account numbers, but also internal verification codes. That could hit debit cards linked to bank accounts, could be used to make “clone” credit cards, or even be used immediately to make purchases on sites with lower security.

While Chipotle knows how many branches were hit, it doesn’t know how many customers or cards were impacted by the breach. Since Chipotle doesn’t collect names and mailing addresses, it’s unable to do any real followup besides announcements on websites and social media.

The data was stolen between March 24 and April 18, reports note, so anyone who noticed anything odd on recent statements may now have a reason why. Chipotle itself, meanwhile, is reportedly likely to face fines from the credit card companies for failing to protect data, and will be on the hook for resulting fraud.

Given that the company only just agreed to pay $18.5 million to settle a data breach from 2013, this news comes at the worst possible time. Its chances of getting users interested in mobile payments have collapsed, though mobile ordering unconnected to payment measures may still be on the table.

This could not have happened at a worst time for a recovering Chipotle, who desperately needed a way to get customers back in the fold.