Chipotle investigating data breach in payment system

NEW YORK (AP) -- Chipotle saw a key sales figure rise more than expected as it works to regain customers' trust after a series of food scares, but may have lost at least a little ground again in disclosing a possible data security issue.

The company said it recently detected unauthorized activity on the network that supports its payment system in restaurants, but believes it has stopped the activity. It said its investigation is focused on restaurant transactions between March 24 and April 18 of this year, and would not provide further details since the investigation is still going on.

A Chipotle representative said the company has notified card networks, which notifies issuing banks, which in turn notifies customers.

The Denver-based chain said earlier that sales rose 17.8 percent at established locations for the three months ended March 31, following a 29.7 percent decline in the year-ago quarter. Sales at stores open at least 13 months had turned positive in December after dropping steeply starting in late 2015. The 13-month metric is a considered a key indicator because it strips out the volatility of newly opened and closed locations.

Since the E. coli and other food scares that started sickening people around country more than a year ago, Chipotle has pledged to ensure that its food is safe, offered coupons for free burritos, stepped up advertising and introduced a temporary loyalty program to get people back in its stores. The company also added chorizo as a topping to lure more customers.

Chipotle said Tuesday that it will start testing a dessert next month. CEO Steve Ells described the dessert, bunuelos, as fried tortilla strips with honey and sugar with an apple and caramel dipping sauce. The company has felt confident enough to raise prices by about 5 percent in about 440 restaurants, but said it will evaluate how that goes over before expanding the price hikes elsewhere.

For the quarter, Chipotle Mexican Grill Inc. earned $46.1 million, or $1.60 per share, following a loss in the year-ago period. Analysts had expected $1.29 per share, according to FactSet. Total revenue was $1.07 billion, topping the $1.05 billion analysts expected.

The company has continued building new locations, and ended the quarter with 2,291 stores.

Chipotle shares rose 3 percent in after-hours trading.

Chipotle posted on its website about the data security incident:

"We want to make our customers aware that we recently detected unauthorized activity on the network that supports payment processing for purchases made in our restaurants. We immediately began an investigation with the help of leading cyber security firms, law enforcement, and our payment processor. We believe actions we have taken have stopped the unauthorized activity, and we have implemented additional security enhancements. Our investigation is focused on card transactions in our restaurants that occurred from March 24, 2017 through April 18, 2017. Because our investigation is continuing, complete findings are not available and it is too early to provide further details on the investigation. We anticipate providing notification to any affected customers as we get further clarity about the specific timeframes and restaurant locations that may have been affected.

"Consistent with good practices, consumers should closely monitor their payment card statements. If anyone sees an unauthorized charge, they should immediately notify the bank that issued the card. Payment card network rules generally state that cardholders are not responsible for such charges."