Credit Cards News

So Chipotle got hacked... now what?

Alex Cohen Alex Cohen  | 

Yesterday, your favorite Mexican fast food chain announced that the majority of its stores had credit card systems that were affected with malware. This isn't the best news, as Chipotle has thousands of stores and processes millions of orders every single day. If you're a frequent Chipotle-goer, you could be one of the many people impacted by this data breach. In simple terms - if hackers have your credit card numbers they can use your cards to make unauthorized purchases and rack up spending that isn't actually you. Here a few simple steps to follow to see if your accounts were compromised and what you can do from here:

1. See if you ate at Chipotle during the time frame in which their systems were impacted. Chipotle has more information here but the quick summary is that their systems had malware between March 24, 2017 and April 18, 2017 and the majority of stores were affected. You can use Birch to see if you may have made a Chipotle purchase during that time. Log into the Birch app and navigate to the spending -> transactions tab. You can then filter your dates to March 24 - April 18 and "Chipotle" transactions.

You can also do this on mobile by navigating into the app, tapping on spending and doing the same filter.

In my case, I had one Chipotle transaction on our Capital One Spark for Business Card during that time period. Although I don't have any recent fraudulent activity, I'm still keeping an eye on my recent transactions to make sure there isn't any strange activity (you can do this by resetting your filters back to default, and then filtering off the other bank accounts you don't want to see.

You can expand the transaction details to see if there is more information, specifically the address of the merchant. Doing so shows that I made this purchase at the Chipotle store on Market St.

2. Use the new Chipotle tool that shows you which stores were affected and on what days.

Unfortunately, 525 Market Street was impacted during the days I shopped, so we've still got a couple of more steps to follow. If you made a purchase at a store on this list, it's in your best interest to move forward with the next step. If your store isn't on this list you shouldn't have to worry!

3. Call your bank and have them cancel your old card and issue you a new one. If there's any fraud on the account, you won't be liable. Banks are usually fantastic in dealing with these situations and understand that it wasn't you who made these fraudulent purchases. The same applies for a debit card linked to a checking account - call your bank right away! This website has a pretty extensive list of customer support numbers for banks, but the easiest way to get the number is on the back of your card.

The only difference between your debit and credit card, and why we always recommend using a credit card when you can, is that those funds will credit back to your credit account immediately. With a debit card, that cash is tied up for 7-10 days.

Although this is unfortunate for Chipotle and consumers who eat at their restaurant, this isn't super uncommon. Other large merchants have had breaches recently and it's always best to keep an eye on your spending. We love the Birch app because it aggregates all of your accounts in one, beautiful dashboard.

Have a question? Shoot an email to

Alex Cohen

Alex Cohen

I run Birch by day and watch cat videos by night

San Francisco, CA