On December 23, 2025, Chipotle disclosed that unauthorized actors accessed Workday profiles of current and former employees from October 9–26, 2025. By November 7, 2025, the company said sensitive personal information may have been exposed, including Social Security numbers, dates of birth, direct deposit account and routing numbers, and other PII. The breach poses risks such as identity theft, financial and tax fraud. Chipotle is notifying affected individuals; current or former employees who received notice or suspect compromise may have legal rights and could be eligible for a class action.