As our reliance on technology has grown, the scope and severity of potential risks from cyber threats has increased. Many of our information technology systems (whether cloud-based or hosted in proprietary servers), including those used for our point-of-sale, web and mobile platforms, online and mobile payment systems, delivery services and rewards programs and administrative functions, contain personal, financial or other information that is entrusted to us by our guests, business partners and employees. Many of our information technology systems also contain confidential information about our business, such as business strategies, development initiatives and designs, and confidential information about third parties, such as suppliers. Similar to many other restaurant companies, we have in the past experienced, and we expect to continue to experience, cyber-attacks, including phishing, and other attempts to breach, or gain unauthorized access to, our systems and databases. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that they will not have an impact in the future.
Our third-party providers’ and business partners’ information technology systems and databases are subject to similar risks. The number and frequency of these attempts varies from year to year and increases as the scope and scale of our technology footprint and digital operations increases. In addition, we provide guest and employee data, as well as confidential information important to our business to third parties. Individuals performing work for us and these third parties also may access some of this data, including on personally owned digital devices. To the extent we, a third party or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of guests’ or employees’ data or confidential information of Chipotle stored in or transmitted through such systems, including through cyber-attacks or other external or internal methods, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain guests or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business, loss of business partners and licensees and the disruption to our supply chain, business and plans. Unauthorized access, theft, use, destruction or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing, deepfakes, ransomware, malware or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.
Given the increasing complexity and sophistication of techniques used by bad actors to obtain unauthorized access to or disable information technology systems, and the fact that cyberattacks are being made by groups and individuals with a wide range of expertise and motives, it is increasingly difficult to anticipate and defend against cyberattacks, and a cyberattack could occur and persist for an extended period of time before being detected. Moreover, the extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it may take a significant amount of time before such investigation can be finalized and completed and reliable information about the incident is known. During the pendency of any such investigation, we may not know the extent of the harm or how best to remediate it, and we may be required to disclose incidents before their full extent is known.
Such security breaches also could result in a violation of applicable U.S. and international privacy, cyber and other laws or trigger data breach notification laws, including new disclosure rules promulgated by the SEC, and subject us to private third party or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. These risks also exist in companies that license our brand, that we partner with or invest in that use separate information systems.
We may be required to make significant capital investments and other expenditures to investigate security incidents, remedy cybersecurity problems, recuperate lost data, prevent future compromises and adapt systems and practices to react to the changing threat environment. These include costs associated with notifying affected individuals and other agencies, additional security technologies and training, hiring additional employees, retention of experts and providing credit monitoring services for individuals whose data has been breached. These costs could be material and could adversely impact our results of operations in the period in which they are incurred, including by causing us to delay the pursuit of other important business strategies and initiatives, and may not meaningfully limit the success of future attempts to breach our information technology systems.
Media or other reports of existing or perceived security vulnerabilities in our systems or those of our third-party business partners or service providers can also adversely impact our brand and reputation and negatively impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns. We continue to make significant investments in technology, third-party services and employees to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.