Data breach at Chipotle Mexican Grill exposes employees' Social Security Numbers

On Dec. 23, 2025, Chipotle Mexican Grill, Inc., disclosed a significant data breach exposing personally identifiable information (PII) of current and former employees. So far, the data breach has impacted at least 31 individuals in Maine and two in New Hampshire. However, this in an ongoing investigation and the number of impacted individuals is subject to change.

According to the disclosure, Workday profiles of Chipotle employees were accessed by an unauthorized threat actor October 9 and October 26, 2025. By Nov. 7, 2025, the company determined that sensitive information of certain current and former employees were compromised. Exposed information includes Social Security number, date of birth, account number, and routing number. The exposure of PII puts employees at risk of identity theft and financial fraud.

The breach follows a pattern that's been seen across various companies of individuals having used phishing, social engineering, and other methods to obtain access to Workday payroll accounts of employees to divert direct deposit payments. As such, this breach was not a compromise of Workday's systems but rather it is specific to Chipotle's instance only.

Beginning on Dec. 23, 2025, the company disclosed the data breach to the Attorney Generals' offices in New Hampshire, Massachusetts and Vermont. Impacted individuals have been notified by mail.

Chipotle's response

After identifying the breach, Chipotle took steps to investigate the incident and limit further exposure of personal information. In response to the breach, the company is offering complimentary Kroll Identity Monitoring services to impacted individuals.

If you receive notification from Chipotle about this breach, you may want to:

• Sign up for the free Kroll Identity Monitoring services, offered by Chipotle.
• Monitor your credit reports and financial accounts for any unusual activity.
• Be alert for phishing emails or phone calls that may use your exposed information.
• Consider placing a fraud alert or credit freeze with major credit bureaus.

For affected individuals with questions, Chipotle has set up a call center at 844-574-1154, Monday through Friday, 9 a.m. to 6:30 p.m. ET.