Chipotle Mexican Grill cannot catch a break. Just as the fast-casual chain reported that sales have rebounded after a prolonged slog in the wake of a food safety outbreak, executives told Wall Street analysts that the company’s payment processing system was hacked.
“We want to make our customers and investors aware we recently detected unauthorized activity on a network that supports payment processing for purchases made in our restaurants,” chief financial officer Jack Hartung told analysts during an investor presentation. He said that Chipotle (CMG) had implemented additional security measures, actions it believes stopped the unauthorized activity, which the restaurant chain estimates occurred between March 24 through April 18.
Chipotle says it is also working with a cyber security firm, law enforcement, and the payment processor to address the matter.
“We will refrain from providing additional commentary now or in the Q&A,” said Hartung. “We anticipate notifying any affected customers as we get further clarity about the time frames and the restaurant locations that might have been affected.”
The hacking news dulled the enthusiasm around the other big news that Chipotle reported on Wednesday: the strongest quarterly financial results from the restaurant chain since the fall of 2015, when sales started to get dented from a prolonged food safety crisis. The food safety story generated headlines throughout much of 2016 as the company struggled to contain the proper messaging after an E. Coli outbreak hit several states called into question Chipotle’s promise of serving fresher and healthier foods than rivals like McDonald’s (MCD). Sales in the wake of that outbreak sputtered for all of 2016, with same-restaurant sales—a key metric that excludes sales from new establishments—falling for five straight quarters.
But Chipotle finally broke that trend, reporting comparable restaurant sales surged a better-than-expected 17.8% while total revenue jumped 28% to $1.07 billion.
“In December of last year I returned to the role of sole CEO with a commitment to restoring the simplicity that made Chipotle so successful,” CEO Steve Ells told analysts during a presentation. “Since December, we’ve implemented sweeping changes throughout the organization, nearly all of which are aimed at dramatically improving the guest experience.”
Ells and the rest of the management team at Chipotle have been busy aiming to change the narrative around the chain away from food safety and back toward just food. In the past year, it has launched a rewards program, a recent major TV ad campaign, and continued to advance the company’s “clean” food promise as ways to bolster the brand. The company has also begun testing some price increases—it last enacted a national increase in the middle of 2014 and since then, has had to absorb higher labor and food inflation costs. The E. Coli outbreak dissuaded management from trying to increase prices any further as it focused on a recovery.
Before Hartung told Wall Street about the hacking news, the company’s stock jumped by over 6% in after-hours trading. It is currently up a more modest 3.4%. Still, through Wednesday’s close, Chipotle’s shares have increased 25% in 2017.