Chipotle Serves Up Chips, Guac & HR Email
Summary: Chipotle's HR department sent job-applicant emails from the return address chipotlehr.com, a domain the company never owned or controlled, until KrebsOnSecurity reader Michael Kohlman noticed a bounce message, checked the ownership records, and bought the domain for $30. Kohlman found a steady stream of wayward emails to the address from job seekers and people seeking password help for the Chipotle HR portal, and Chipotle spokesman Chris Arnold said the domain was never functional and there was never a security risk, adding it is being changed to careers.chipotle.com.
What you should know: Every message sent to that HR address, including password-reset requests, landed in a mailbox controlled by whoever registered the domain first, and Chipotle declined Kohlman's offer to hand it over for free.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026