The Breach Blog informs us of a laptop theft where Chipotle employee information (name, address, social security number) was on a laptop that got stolen…dang.

My questions are:

1 Why wasn’t this on an encrypted hard-drive so that there is no problem. I worked at an accounting firm once that encrypted every single hard drive that required a strong password to get in which would help.

2 Why does this company need the full social security number? What scenarios is that necessary to have for every employee?

Hey Greg,

I think I met you once over at our LoDo Restaurant in Denver. In any case, so that your readers know, I’m a Chipotle employee, and I hope you don’t mind if I respond. We are sorry to have caused you anxiety over these reports of late. We’d like to emphasize that the safety and well-being of our customers and employees is, and always has been, our highest priority – and food safety plays a big part in that. We would like you to know that what happened in La Mesa, CA and what happened in Kent, OH are separate and completely isolated events, completely inconsistent with our long-standing track record of excellent service and quality.

As for La Mesa, our restaurant there has been inspected by the San Diego Department of Environmental Health five times in the last five months, including two times during the week of April 21 and has received an “A” or excellent rating each time. 100 percent of our entire staff at La Mesa has been tested by the health department, given clean test results and allowed to work. At this time, the health department has not reached a conclusion as to the source of the Hepatitis A cases in the area, but they have deemed it completely safe for us to remain open. We will continue to cooperate with the health department fully in this regard as they continue their investigation.

As for Kent, this is believed by the local health department to be a norovirus (which is a communicable illness that is spread very easily from person to person). We took a number of voluntary steps to ensure the well-being of our customers and our employees, including the temporary closing and complete sanitization of our restaurant. Additionally, Chipotle has established a claims program and process for the reimbursement of related medical expenses. Since then, our Kent restaurant has remained open with the full support of the local health department. A follow up inspection conducted by the health department there found that our restaurant met or exceeded all health department requirements. However, most definitely, we will continue to assist the health department as it completes its investigation.

Thank you for allowing me to post this information. As for the stolen laptop, I don’t know what to say about that one. I had previously thought that sort of thing only happened with the federal government….

Sincerely,

Joe Stupp
Chipotle

Mitch Wagner wrote about Chipotle’s blog commenting in the wake of the hepatitis outbreak incident. It’s mostly amazing to me for the nugget where Joe reveals that they get about 200 comments per day through the website. That’s a lot.

I also like this quote:

People feel that a big company is speaking to them directly (and we are), and hopefully realize that we actually care. Traditional media is great, but with all the massive amounts of media out there, sometimes the messages we or anyone tries to send through traditional channels get lost in the clutter and the noise. Sometimes it’s better to go it one person at a time, like we do through our website communication, too.

It’s interesting to me because it makes me wonder - if the whole “less is more” is part of the philosophy behind the website, how do they decide which bits of information to put into the FAQ and which they are happy answering as they come in 20 times a day? If it were up to me, I’d create a system that allowed for tagging the incoming mails by category which would also pre-populate a response email with some cut and paste boilerplate. This would allow for measuring of which questions come in a lot (Can I franchise?) and then allow them to decide better which items to feature more prominently on the website.