Gordon, et al. v. Chipotle Mexican Grill, Inc., No. 1:17-cv-01415-CMA-SKC (D. Colo.)

Chimicles Schwartz Kriner & Donaldson-Smith LLP (“CSK&D”) filed this class action lawsuit against Chipotle Mexican Grill Inc. (“Chipotle”) following Chipotle’s announcement in early 2017 that it detected a security breach in its payment card environment. Following the completion of its breach investigation, Chipotle “identified the operation of malware designed to access payment card data from cards used on point-of-sale (POS) devices at certain Chipotle and Pizzeria Locale restaurants between March 24, 2017 and April 18, 2017. The malware searched for track data (which sometimes has cardholder name in addition to card number, expiration date, and internal verification code) read from the magnetic stripe of a payment card as it was being routed through the POS device.”

Plaintiffs largely prevailed over multiple attempts by Chipotle to have the case dismissed. After filing an Amended Complaint in October 2018, Chipotle filed an Answer.

The parties subsequently agreed to participate in a mediation, which proved to be successful as the parties reached an agreement to settle this case. The settlement received final approval from the Court on December 16, 2019.

Under the terms of the settlement, all class members who submitted a valid claim during the claim period are entitled to reimbursements of up to $250 for certain categories of ordinary expenses incurred as a result of the data breach, such as unreimbursed charges or fees from banks or credit card companies. Class members may also be entitled to reimbursement of extraordinary expenses of up to $10,000.

CSK&D served as co-lead counsel for Plaintiffs and the class of consumers who used a payment card at one of the Chipotle locations affected by the breach.

More information about the settlement can be found on the settlement website at

(*) Indicates required field: When communicating with us through this site or otherwise in connection with a matter for which we do not already represent you, your communication may not be treated as privileged or confidential, and does not create an attorney-client relationship between you and our Firm.

Attorneys for this case:

Benjamin F. Johns