Where does the Chipotle Mexican Grill, Inc. and Workday case file come from?

Every entry is taken from the breach report Chipotle Mexican Grill, Inc. and Workday lodged with the New Hampshire Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: Chipotle Mexican Grill, Inc. and Workday Data Breach

This file collects the dated facts on record for the Chipotle Mexican Grill, Inc. and Workday incident. The state report is dated December 23, 2025.

Timeline

December 23, 2025Report filed in New HampshireDate the notice was lodged with the New Hampshire Attorney General.

Case facts

Filing state: New Hampshire
Date reported: December 23, 2025
Receiving office: New Hampshire Attorney General

Case notes

Chipotle Mexican Grill, Inc., in conjunction with Workday, has submitted a data breach notification to the State of New Hampshire. This disclosure, dated December 23, 2025, formally informs regulators of a security incident impacting personal information. Details surrounding the nature and scope of this event are currently under investigation, as stated in the public filing.

While specific categories of compromised data were not detailed in the public record, the filing confirms that personal information was involved. The notification does not specify how many individuals might be affected by this breach, nor does it provide an exact date when the security incident occurred. The investigation into these aspects is still active.

This notification serves as a formal record that an incident affecting data security has occurred, as reported by the involved organizations to state authorities. Public data breach registries like this one compile such filings to offer transparency and a central reference for affected parties.

Individuals who receive direct notification letters from Chipotle Mexican Grill, Inc. or Workday should review them carefully for specific advice. As a general precaution, it is wise to remain vigilant for unexpected communications or suspicious activity. Consider monitoring any accounts linked to services used with these organizations for unauthorized access.

Implementing strong, unique passwords for online accounts and enabling multi-factor authentication whenever available are recommended security practices. Be cautious of phishing attempts via email or text messages that might try to exploit concerns related to data breaches. If you receive a letter, follow the guidance provided by the notifying entity.

Questions about this case file

Where does the Chipotle Mexican Grill, Inc. and Workday case file come from?: Every entry is taken from the breach report Chipotle Mexican Grill, Inc. and Workday lodged with the New Hampshire Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

New Hampshire data breaches

Filing source: New Hampshire Attorney General

Named in the Chipotle Mexican Grill, Inc. and Workday breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More New Hampshire case files