Commitments and Contingencies	9 Months Ended
Sep. 30, 2018
Commitments and Contingencies [Abstract]
Commitments and Contingencies	11. Commitments and Contingencies Data Security Incident In April 2017, our information security team detected unauthorized activity on the network that supports payment processing for our restaurants, and immediately began an investigation with the help of leading computer security firms. We also self-reported the issue to payment card processors and law enforcement. Our investigation detected malware designed to access payment card data from cards used at point-of-sale devices at most Chipotle restaurants, primarily in the period from March 24, 2017 through April 18, 2017. The malware searched for track data, which may include cardholder name, card number, expiration date, and internal verification codes; however, no other customer information was affected. We have removed the malware from our systems and continue to evaluate ways to enhance our security measures. We expect that substantially all of our investigation costs will be covered by insurance; however, we may incur legal expenses in excess of our insurance coverage limits associated with the data security incident in future periods. We will recognize these expenses as services are received. As of September 30, 2018, we had a balance of $28,715 included in accrued liabilities on the condensed consolidated balance sheet which represents an estimate of potential liabilities associated with anticipated claims and assessments by payment card networks in connection with the data security incident. We may ultimately be subject to liabilities greater than or less than the amount accrued. Litigation Arising from Security Incident On May 4, 2017, Bellwether Community Credit Union filed a purported class action complaint in the United States District Court for the District of Colorado alleging that we negligently failed to provide adequate security to protect the payment card information of customers of the plaintiffs and those of other similarly situated credit unions, banks and other financial institutions alleged to be part of the putative class, causing those institutions to suffer financial losses. The complaint also claims we were negligent per se based on alleged violations of Section 5 of the Federal Trade Commission Act and similar state laws. The plaintiff seeks monetary damages, injunctive relief and attorneys’ fees. On May 26, 2017, Alcoa Community Credit Union filed a purported class action complaint in the U. S. District Court for the District of Colorado making substantially the same allegations as the Bellwether complaint and seeking substantially the same relief. The Bellwether and Alcoa cases have been consolidated and will proceed as a single action. On October 24, 2018, the court issued an order granting in part and denying in part our motion to dismiss the consolidated complaint, dismissing all claims other than those brought under state unfair competition laws in California and New Hampshire and plaintiffs’ request for declaratory relief. On June 9, 2017, Todd Gordon filed a purported class action complaint in the U. S. District Court for the District of Colorado alleging that we negligently failed to provide adequate security to protect the payment card information of the plaintiff and other similarly situated customers alleged to be part of the putative class, causing some customers to suffer alleged injuries and others to be at risk of possible future injuries. The complaint also claims we were negligent per se based on alleged violations of Section 5 of the Federal Trade Commission Act and similar state laws, and also alleges breach of contract, unjust enrichment, and violations of the Arizona Consumer Fraud Act. Additionally, on August 21, 2017, Greg Lawson and Judy Conard filed a purported class action complaint in the U. S. District Court for the District of Colorado making allegations substantially similar to those in the Gordon complaint, and stating substantially similar claims as well as claims under the Colorado Consumer Protection Act. The Gordon and Lawson/Conard cases have been consolidated and will proceed as a single action. On September 26, 2018, the court issued an order granting in part, and denying in part, our motion to dismiss the consolidated complaint, including a dismissal of the negligence and unjust enrichment claims in their entirety. We intend to continue to vigorously defend each of the aforementioned cases, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from these cases. Although certain fees and costs associated with the data security incident and the aforementioned litigation to date have been paid or reimbursed by our cyber liability insurer, the ultimate amount of liabilities arising from the litigation may be in excess of the limits of our applicable insurance coverage. Receipt of Grand Jury Subpoenas On January 28, 2016, we were served with a Federal Grand Jury Subpoena from the U.S. District Court for the Central District of California in connection with an official criminal investigation being conducted by the U.S. Attorney’s Office for the Central District of California, in conjunction with the U.S. Food and Drug Administration’s Office of Criminal Investigations. The subpoena required the production of documents and information related to company-wide food safety matters dating back to January 1, 2013. We received a follow-up subpoena on July 19, 2017, requesting information related to an illness incident associated with a single Chipotle restaurant in Sterling, Virginia, and another follow-up subpoena on February 14, 2018 requesting information related to an illness incident associated with a single Chipotle restaurant in Los Angeles, California. We intend to continue to fully cooperate in the investigation. It is not possible at this time to determine whether we will incur, or to reasonably estimate the amount of, any fines or penalties in connection with the investigation pursuant to which the subpoenas were issued. Shareholder Class Actions On January 8, 2016, Susie Ong filed a complaint in the U.S. District Court for the Southern District of New York on behalf of a purported class of purchasers of shares of our common stock between February 4, 2015 and January 5, 2016. The complaint purports to state claims against us, each of the co-chief executive officers serving during the claimed class period and the chief financial officer under Sections 10(b) and 20(a) of the Exchange Act and related rules, based on our alleged failure during the claimed class period to disclose material information about our quality controls and safeguards in relation to consumer and employee health. The complaint asserts that those failures and related public statements were false and misleading and that, as a result, the market price of our stock was artificially inflated during the claimed class period. The complaint seeks damages on behalf of the purported class in an unspecified amount, interest, and an award of reasonable attorneys’ fees, expert fees and other costs. On March 8, 2017, the court granted our motion to dismiss the complaint, with leave to amend. The plaintiff filed an amended complaint on April 7, 2017. On March 22, 2018, the court granted our motion to dismiss, with prejudice. On April 20, 2018, the plaintiffs filed a motion for relief from the judgment and seeking leave to file a third amended complaint, and a ruling on the motion remains pending. Additionally, on July 20, 2017, Elizabeth Kelley filed a complaint in the U.S. District Court for the District of Colorado on behalf of a purported class of purchasers of shares of our common stock between February 5, 2016 and July 19, 2017, with claims and factual allegations similar to the Ong complaint, based primarily on media reports regarding illnesses associated with a Chipotle restaurant in Sterling, Virginia. We filed a motion to dismiss the amended complaint on February 12, 2018, and a ruling on the motion remains pending. We intend to continue to vigorously defend the Ong and Kelley cases, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from either of these cases. Miscellaneous We are involved in various other claims and legal actions that arise in the ordinary course of business. We do not believe that the ultimate resolution of these actions will have a material adverse effect on our financial position, results of operations, liquidity or capital resources. However, a significant increase in the number of these claims, or one or more successful claims under which we incur greater liabilities than we currently anticipate, could materially and adversely affect our business, financial condition, results of operations and cash flows.

11. Commitments and Contingencies

Data Security Incident

In April 2017, our information security team detected unauthorized activity on the network that supports payment processing for our restaurants, and immediately began an investigation with the help of leading computer security firms. We also self-reported the issue to payment card processors and law enforcement. Our investigation detected malware designed to access payment card data from cards used at point-of-sale devices at most Chipotle restaurants, primarily in the period from March 24, 2017 through April 18, 2017. The malware searched for track data, which may include cardholder name, card number, expiration date, and internal verification codes; however, no other customer information was affected. We have removed the malware from our systems and continue to evaluate ways to enhance our security measures. We expect that substantially all of our investigation costs will be covered by insurance; however, we may incur legal expenses in excess of our insurance coverage limits associated with the data security incident in future periods. We will recognize these expenses as services are received.

As of September 30, 2018, we had a balance of $28,715 included in accrued liabilities on the condensed consolidated balance sheet which represents an estimate of potential liabilities associated with anticipated claims and assessments by payment card networks in connection with the data security incident. We may ultimately be subject to liabilities greater than or less than the amount accrued.

Litigation Arising from Security Incident

On May 4, 2017, Bellwether Community Credit Union filed a purported class action complaint in the United States District Court for the District of Colorado alleging that we negligently failed to provide adequate security to protect the payment card information of customers of the plaintiffs and those of other similarly situated credit unions, banks and other financial institutions alleged to be part of the putative class, causing those institutions to suffer financial losses. The complaint also claims we were negligent per se based on alleged violations of Section 5 of the Federal Trade Commission Act and similar state laws. The plaintiff seeks monetary damages, injunctive relief and attorneys’ fees. On May 26, 2017, Alcoa Community Credit Union filed a purported class action complaint in the U. S. District Court for the District of Colorado making substantially the same allegations as the Bellwether complaint and seeking substantially the same relief. The Bellwether and Alcoa cases have been consolidated and will proceed as a single action. On October 24, 2018, the court issued an order granting in part and denying in part our motion to dismiss the consolidated complaint, dismissing all claims other than those brought under state unfair competition laws in California and New Hampshire and plaintiffs’ request for declaratory relief.

On June 9, 2017, Todd Gordon filed a purported class action complaint in the U. S. District Court for the District of Colorado alleging that we negligently failed to provide adequate security to protect the payment card information of the plaintiff and other similarly situated customers alleged to be part of the putative class, causing some customers to suffer alleged injuries and others to be at risk of possible future injuries. The complaint also claims we were negligent per se based on alleged violations of Section 5 of the Federal Trade Commission Act and similar state laws, and also alleges breach of contract, unjust enrichment, and violations of the Arizona Consumer Fraud Act. Additionally, on August 21, 2017, Greg Lawson and Judy Conard filed a purported class action complaint in the U. S. District Court for the District of Colorado making allegations substantially similar to those in the Gordon complaint, and stating substantially similar claims as well as claims under the Colorado Consumer Protection Act. The Gordon and Lawson/Conard cases have been consolidated and will proceed as a single action. On September 26, 2018, the court issued an order granting in part, and denying in part, our motion to dismiss the consolidated complaint, including a dismissal of the negligence and unjust enrichment claims in their entirety.

We intend to continue to vigorously defend each of the aforementioned cases, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from these cases. Although certain fees and costs associated with the data security incident and the aforementioned litigation to date have been paid or reimbursed by our cyber liability insurer, the ultimate amount of liabilities arising from the litigation may be in excess of the limits of our applicable insurance coverage.

Receipt of Grand Jury Subpoenas

On January 28, 2016, we were served with a Federal Grand Jury Subpoena from the U.S. District Court for the Central District of California in connection with an official criminal investigation being conducted by the U.S. Attorney’s Office for the Central District of California, in conjunction with the U.S. Food and Drug Administration’s Office of Criminal Investigations. The subpoena required the production of documents and information related to company-wide food safety matters dating back to January 1, 2013. We received a follow-up subpoena on July 19, 2017, requesting information related to an illness incident associated with a single Chipotle restaurant in Sterling, Virginia, and another follow-up subpoena on February 14, 2018 requesting information related to an illness incident associated with a single Chipotle restaurant in Los Angeles, California. We intend to continue to fully cooperate in the investigation. It is not possible at this time to determine whether we will incur, or to reasonably estimate the amount of, any fines or penalties in connection with the investigation pursuant to which the subpoenas were issued.

Shareholder Class Actions

On January 8, 2016, Susie Ong filed a complaint in the U.S. District Court for the Southern District of New York on behalf of a purported class of purchasers of shares of our common stock between February 4, 2015 and January 5, 2016. The complaint purports to state claims against us, each of the co-chief executive officers serving during the claimed class period and the chief financial officer under Sections 10(b) and 20(a) of the Exchange Act and related rules, based on our alleged failure during the claimed class period to disclose material information about our quality controls and safeguards in relation to consumer and employee health. The complaint asserts that those failures and related public statements were false and misleading and that, as a result, the market price of our stock was artificially inflated during the claimed class period. The complaint seeks damages on behalf of the purported class in an unspecified amount, interest, and an award of reasonable attorneys’ fees, expert fees and other costs. On March 8, 2017, the court granted our motion to dismiss the complaint, with leave to amend. The plaintiff filed an amended complaint on April 7, 2017. On March 22, 2018, the court granted our motion to dismiss, with prejudice. On April 20, 2018, the plaintiffs filed a motion for relief from the judgment and seeking leave to file a third amended complaint, and a ruling on the motion remains pending.

Additionally, on July 20, 2017, Elizabeth Kelley filed a complaint in the U.S. District Court for the District of Colorado on behalf of a purported class of purchasers of shares of our common stock between February 5, 2016 and July 19, 2017, with claims and factual allegations similar to the Ong complaint, based primarily on media reports regarding illnesses associated with a Chipotle restaurant in Sterling, Virginia. We filed a motion to dismiss the amended complaint on February 12, 2018, and a ruling on the motion remains pending.

We intend to continue to vigorously defend the Ong and Kelley cases, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from either of these cases.

Miscellaneous

We are involved in various other claims and legal actions that arise in the ordinary course of business. We do not believe that the ultimate resolution of these actions will have a material adverse effect on our financial position, results of operations, liquidity or capital resources. However, a significant increase in the number of these claims, or one or more successful claims under which we incur greater liabilities than we currently anticipate, could materially and adversely affect our business, financial condition, results of operations and cash flows.