(Reuters) - Hackers used malware to steal customer payment data from most of Chipotle Mexican Grill Inc’s (CMG.N) restaurants over a span of three weeks, the company said on Friday, adding to woes at the chain whose sales had just started recovering from a string of food safety lapses in 2015.

Chipotle said it did not know how many payment cards or customers were affected by the breach that struck most of its roughly 2,250 restaurants for varying amounts of time between March 24 and April 18, spokesman Chris Arnold said via email.

A handful of Canadian restaurants were also hit in the breach, which the company first disclosed on April 25.

Stolen data included account numbers and internal verification codes. The malware has since been removed.

The information could be used to drain debit card-linked bank accounts, make “clone” credit cards, or to buy items on certain less-secure online sites, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

The breach could once again threatens sales at its restaurants, which only recently recovered after falling sharply in late 2015 after Chipotle was linked to outbreaks of E. coli, salmonella and norovirus that sickened hundreds of people.

An investigation into the breach found the malware searched for data from the magnetic stripe of payment cards.

Arnold said Chipotle could not alert customers directly as it did not collect their names and mailing addresses at the time of purchase.

The company posted notifications on the Chipotle and Pizzeria Locale websites and issued a news release to make customers aware of the incident.

Linn Freedman, an attorney at Robinson & Cole LLP specializing in data breach response, said Chipotle was putting the burden on the consumer to discover possible fraudulent transactions by notifying them through the websites.

“I don’t think you will get to all of the customers who might have been affected,” she said.

Security analysts said Chipotle would likely face a fine based on the size of the breach and the number of records compromised.

“If your data was stolen through a data breach that means you were somewhere out of compliance” with payment industry data security standards, Julie Conroy, research director at Aite Group, a research and advisory firm.

“In this case, the card companies will fine Chipotle and also hold them liable for any fraud that results directly from their breach,” said Avivah Litan, a vice president at Gartner Inc (IT.N) specializing in security and privacy.

Chipotle did not immediately comment on the prospect of a fine.

Signage for a Chipotle Mexican Grill is seen in Los Angeles, California, United States, April 25, 2016. REUTERS/Lucy Nicholson/File Photo

Retailer Target Corp (TGT.N) in 2017 agreed to pay $18.5 million to settle claims stemming from a massive data breach in late 2013.

Hotels and restaurants have also been hit. They include Trump Hotels, InterContinental Hotels Group (IHG.L) as well as Wendy’s (WEN.O), Arby’s and Landry’s restaurants.

Shares in Chipotle Mexican Grill ended marginally lower at $480.15 on Friday following the announcement.</s>May 26 (Reuters) - Chipotle Mexican Grill Inc said on Friday hackers used malware to access customers' card data, including its number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18.

An investigation into the breach found the malware searched for track data from the magnetic stripe of payment cards used in certain Chipotle and Pizzeria Locale restaurants.

The Mexican food chain said the malware has since been removed.</s>Chipotle Mexican Grill Inc said on Friday hackers used malware to access customers' card data, including its number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18.

REUTERS: Chipotle Mexican Grill Inc said on Friday hackers used malware to access customers' card data, including its number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18.

An investigation into the breach found the malware searched for track data from the magnetic stripe of payment cards used in certain Chipotle and Pizzeria Locale restaurants.

The Mexican food chain said the malware has since been removed.</s>Chipotle Mexican Grill Inc said on Friday hackers used malware to access customers' card data, including its number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18. Signage for a Chipotle Mexican Grill is seen in Los Angeles, California, United States, April 25, 2016. REUTERS/Lucy Nicholson/File Photo REUTERS: Chipotle Mexican Grill Inc said on Friday hackers used malware to steal customers' card data, including account number, expiration date and internal verification codes, from payment systems at some of its restaurants over a span of three weeks.

Start the conversation, or Read more at Channelnewsasia.com.</s>Chipotle Mexican Grill Inc. said on Friday hackers used malware to steal customers' card data, including account number, expiration date and internal verification codes, from payment systems at some of its restaurants over a span of three weeks. Chipotle, which is fighting to recover from 2015 food safety lapses that pummeled its sales, said it did not know how many payment cards had been affected but said the malware has since been removed.

Start the conversation, or Read more at News Max.</s>LOS ANGELES — Chipotle Mexican Grill on Friday said new information on a March-April data breach at its restaurants indicates hackers using malware stole customer payment information.

Consumers' account numbers, expiration data and verification codes were accessed by the malware from payment card systems at the fast-casual chain over three weeks between March 24 and April 18. Chipotle said the malware that breached its system has been removed. Most of its 2,249 restaurants were affected, said company spokesperson Chris Arnold.

"Because of the nature of the incident and the data involved, we lack sufficient information to determine how many unique payment cards may have been involved," he said.

The company has been working hard to rebound from food safety issues in 2015 that resulted in a sales drop. The company has since been climbing back, with its stock up to $480.15 on Friday. On January 4th, the first trading day of the year, Chipotle stock traded for $381 a share.

The company said consumers should check their credit card statements for unauthorized activity and report unauthorized charges to the card issuer. "Payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner."

Chipotle said it's working with cyber security firms to evaluate ways to enhance security measures. In addition, "we...are working with the payment card networks so that the banks that issue payment cards can be made aware and initiate heightened monitoring."

The company set up a toll-free number to take calls about the breach, 888-738-0534. For more information, check out the Chipotle security web page: https://www.chipotle.com/security#security</s>Chipotle Mexican Grill Inc said on Friday hackers used malware to access customers' card data, including its number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18.

REUTERS: Chipotle Mexican Grill Inc said on Friday hackers used malware to steal customers' card data, including account number, expiration date and internal verification codes, from payment systems at some of its restaurants over a span of three weeks.

Chipotle, which is fighting to recover from 2015 food safety lapses that pummeled its sales, said it did not know how many payment cards had been affected but said the malware has since been removed.

The information could be used to drain bank accounts, if a debit card was used, or to make credit card purchases, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

An investigation into the breach found the malware searched for track data from the magnetic stripe of payment cards.

Most of Chipotle's U.S. restaurants may have been affected by the breach for varying amounts of time between March 24 and April 18, spokesman Chris Arnold said via email.

Chipotle, which operates 2,249 U.S. restaurants, is not offering credit monitoring or notifying affected customers directly, as many other chains have in the past.

"Credit monitoring is only designed to let you know when someone is opening a new credit account using your information. Credit monitoring does not alert you when a fraudulent charge is made on a payment card," Arnold said.

He also noted that Chipotle could not alert customers directly as it did not collect their names and mailing addresses at the time of purchase.

The company said it had posted a notification on the Chipotle and Pizzeria Locale websites and issued a press release to make guests aware of the incident.

Linn Freedman, an attorney at Robinson & Cole LLP specializing in data breaches, said Chipotle was putting the burden on the consumer to discover possible fraudulent transactions by notifying them through the websites.

"I don't think you will get to all of the customers who might have been affected," she said.

Shares in Chipotle Mexican Grill ended marginally lower at US$480.15 on Friday.</s>May 26 (Reuters) - Chipotle Mexican Grill Inc said on Friday hackers used malware to steal customers card data, including account number, expiration date and internal verification codes, from payment systems at some of its restaurants between March 24 and April 18.

Chipotle, which is fighting to recover from 2015 food safety lapses that pummeled its sales, said it did not know how many payment cards had been affected but said the malware has since been removed.

The information could be used to drain bank accounts, if a debit card was used, or to make credit card purchases, said Paul Stephens, director of policy and advocacy at the non-profit Privacy Rights Clearinghouse.

An investigation into the breach found the malware searched for track data from the magnetic stripe of payment cards used in certain Chipotle and Pizzeria Locale restaurants.

Chipotle is not offering credit monitoring, as many other chains have in the past.

"Credit monitoring is only designed to let you know when someone is opening a new credit account using your information. Credit monitoring does not alert you when a fraudulent charge is made on a payment card," spokesman Chris Arnold said in an email to Reuters.

Shares in the chain were down nearly 0.1 percent at $481.02 in late trading on Friday. (Reporting by Natalie Grover in Bengaluru and Lisa Baertlein in Los Angeles; Editing by Arun Koyyur and Grant McCool)</s>May 26 Hackers used malware to steal customer payment data from most of Chipotle Mexican Grill Inc's restaurants over a span of three weeks, the company said on Friday, adding to woes at the chain that has just started recovering from a string of food safety lapses in 2015.</s>It seems the data hack at Chipotle Mexican Grill was a bit wider than the company originally disclosed.

A month after Chipotle told consumers that it had detected "unauthorized activity" on a network that supports payment processing for purchases made at its Mexican chain restaurants, the company said that Pizzeria Locale restaurants were also affected.

The breach, which Chipotle said took place between March 24 and April 18, collected track data from some customers.

Track data is information transferred when a credit card's magnetic strip is swiped through the point-of-service device. Chipotle said that information could have included the card holder's name, card number, expiration date and verification code.

"There is no indication that other customer information was affected," the company said in a statement Friday.

Chipotle has since removed the malware and said that it continues to work with cybersecurity firms to beef up its safety measures.

The restaurant warned customers to closely monitor their payment card statements and notify their bank if they see an unauthorized charge.
A spokesman for the Chipotle Mexican Grill restaurant chain reveals that hackers stole customer payment data from most of their stores over a span of three weeks starting from the end of March.