XML 30 R18.htm IDEA: XBRL DOCUMENT v3.19.1
Commitments and Contingencies
3 Months Ended
Mar. 31, 2019
Commitments and Contingencies [Abstract]  
Commitments and Contingencies

11. Commitments and Contingencies

Purchase Obligations

We enter into various purchase obligations in the ordinary course of business, generally of a short-term nature. Those that are binding primarily relate to commitments for food purchases and supplies, amounts owed under contractor and subcontractor agreements, orders submitted for equipment for restaurants under construction, and marketing initiatives and corporate sponsorships.

Litigation

Data Security Incident  

In April 2017, our information security team detected unauthorized activity on the network that supports payment processing for our restaurants, and immediately began an investigation with the help of leading computer security firms. We also self-reported the issue to payment card processors and law enforcement. Our investigation detected malware designed to access payment card data from cards used at point-of-sale devices at most Chipotle restaurants, primarily in the period from March 24, 2017 through April 18, 2017. The malware searched for track data, which may include cardholder name, card number, expiration date, and internal verification codes; however, no other customer information was affected. We removed the malware from our systems and continue to work to enhance our security measures. Substantially all of our investigation costs have been covered by insurance; however, we may incur legal and other expenses in excess of our insurance coverage limits associated with the data security incident in future periods. We will recognize these expenses as services are received.    

As of March 31, 2019, we had a balance of $24,701 included in accrued liabilities on the condensed consolidated balance sheet which represents an estimate of potential liabilities associated with anticipated claims and assessments by payment card networks in connection with the data security incident. We may ultimately be subject to liabilities greater than or less than the amount accrued.

Litigation Arising from Data Security Incident  

During the three months ended March 31, 2019, we reached agreements to settle the consolidated action captioned Bellwether Community Credit Union, et. al. v. Chipotle Mexican Grill, Inc., as well as the consolidated action captioned Todd Gordon, et. al. v. Chipotle Mexican Grill, Inc., each of which was pending in the United States District Court for the District of Colorado.  Settlement of the Bellwether matter has been finalized and a stipulation of dismissal was filed with the court on March 28, 2019.  Court approval of the Gordon settlement is pending.  We do not expect that the settlements will exceed applicable insurance coverages or will have a material financial impact on us, although the total liabilities arising from the Gordon settlement will be dependent in part on the number of claims filed, and may exceed our expectations and applicable insurance coverage.



Receipt of Grand Jury Subpoenas   



On January 28, 2016, we were served with a Federal Grand Jury Subpoena from the U.S. District Court for the Central District of California in connection with an official criminal investigation being conducted by the U.S. Attorney’s Office for the Central District of California, in conjunction with the U.S. Food and Drug Administration’s Office of Criminal Investigations. The subpoena required the production of documents and information related to company-wide food safety matters dating back to January 1, 2013.  Since then we have received two other subpoenas on the following dates requesting information related to illness incidents associated with the following specific restaurants:  July 19, 2017, requesting information about a single Chipotle restaurant in Sterling, Virginia; and February 14, 2018, requesting information about a single Chipotle restaurant in Los Angeles, California. On April 18, 2019, we received a new subpoena requesting information related to illness incidents associated with the specific restaurants in Simi Valley, California, Boston, Massachusetts, Sterling, Virginia, and Los Angeles, California that were covered under the previous subpoenas, plus one additional restaurant in Powell, Ohio.  We have fully cooperated and intend to continue to fully cooperate in the investigation.  It is not possible at this time to determine whether we will incur, or to reasonably estimate the amount of, any fines or penalties in connection with the investigation pursuant to which the subpoenas were issued.

Shareholder Class Actions   

On January 8, 2016, Susie Ong filed a complaint in the U.S. District Court for the Southern District of New York on behalf of a purported class of purchasers of shares of our common stock between February 4, 2015 and January 5, 2016. The complaint purports to state claims against us, each of the co-Chief Executive Officers serving during the claimed class period and the Chief Financial Officer under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and related rules, based on our alleged failure during the claimed class period to disclose material information about our quality controls and safeguards in relation to consumer and employee health. The complaint asserts that those failures and related public statements were false and misleading and that, as a result, the market price of our stock was artificially inflated during the claimed class period. The complaint seeks damages on behalf of the purported class in an unspecified amount, interest, and an award of reasonable attorneys’ fees, expert fees and other costs. On March 8, 2017, the court granted our motion to dismiss the complaint, with leave to amend. The plaintiff filed an amended complaint on April 7, 2017. On March 22, 2018, the court granted our motion to dismiss, with prejudice. On April 20, 2018, the plaintiffs filed a motion for relief from the judgment and seeking leave to file a third amended complaint, and on November 20, 2018, the court denied the motion.  On December 20, 2018, the plaintiff initiated an appeal to the U.S. Court of Appeals for the Second Circuit. 

Additionally, on July 20, 2017, Elizabeth Kelley filed a complaint in the U.S. District Court for the District of Colorado on behalf of a purported class of purchasers of shares of our common stock between February 5, 2016 and July 19, 2017, with claims and factual allegations similar to the Ong complaint, based primarily on media reports regarding illnesses associated with a Chipotle restaurant in Sterling, Virginia. On March 29, 2019, the court granted our motion to dismiss, with prejudice. 

We intend to continue to vigorously defend the Ong and Kelley cases through any further appeals, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from either of these cases.

Miscellaneous

We are involved in various other claims and legal actions that arise in the ordinary course of business. We do not believe that the ultimate resolution of these actions will have a material adverse effect on our financial position, results of operations, liquidity or capital resources. However, a significant increase in the number of these claims, or one or more successful claims under which we incur greater liabilities than we currently anticipate, could materially and adversely affect our business, financial condition, results of operations and cash flows.