Hacker News Reader

Comment by bpicolo | Hacker News Reader

That's a massive list. 2249 restaurants.

I am appalled at the attempt by Chipotle to downplay the scope and scale of the incident. The sentence which reads, " Not all locations were involved, and the specific time frames vary by location", is a blatant attempt to deflate the significance of the problem. This public disclosure should have been more direct, and disclose in plain language the number of stores affected. Chipotle should explain the full impact in plain language: "2,249 out of X,XXX Chipotle restaurants were compromised."

Well, they basically have no idea -- it says in bold letters "Please note that not all locations were identified."

For reference, Wikipedia claims Chipotle has 3,010 restaurants. So at least 75%.

They are international now, right? I at least think I have memory of running across them in Canada.

The file name in question (thanks, heywire) is "us.json". I'm left wondering whether and how much of an international scope there might be to this.

While the version of their web site that I'm receiving by default seems to be geo-centric to the U.S. and doesn't mention foreign locations, Wikipedia has:

https://en.wikipedia.org/wiki/Chipotle_Mexican_Grill

Chipotle Mexican Grill, Inc. (/tʃᵻˈpoʊtleɪ/)[6] is an American chain of fast casual restaurants in the United States, United Kingdom,[7] Canada,[8][9] Germany,[10] and France

There's a Canada one at the least, too. https://drpma142ptgxf.cloudfront.net/assets/campaigns/2017-s...

Card processing in Europe is secure and doesn't ever involve magstripe data, so it won't have been a problem.

I think there are around 3,000 total restaurants, so that's 75% affected...

The only ones not affected are most likely the ones that are part of airports/universities/hospitals that require integration with the building's POS system instead of their own.

Reply on news.ycombinator.com