Privacy & Information Security Law Blog: Chipotle Consumer Plaintiffs' Putative Class Case Survives In Part

On September 26, 2018, the U.S. District Court for the District of Colorado ("the Court") refused to dismiss all putative class claims against Chipotle Mexican Grill, Inc. ("Chipotle"). This litigation arose from a 2017 data breach in which hackers stole customers' payment card and other personal information by using malicious software to access the point-of-sale systems at Chipotle's locations. 

Chipotle moved to dismiss all claims, arguing that two of the named plaintiffs – Plaintiff Lawson and Plaintiff Baker – lacked standing and that all other plaintiffs failed to state a claim. The motion was first considered by a United States Magistrate Judge, who recommended granting only part of Chipotle's requested relief. Both Plaintiffs and Chipotle objected to portions of the recommendation. The District Court Judge agreed with the recommendation in part.