The suit also claims that, among other things, Chipotle failed to ensure it maintained adequate security measures, didn't use best practices and didn't upgrade its security systems. Bellwether also alleged that Chipotle hasn't implemented EMV in its stores.

Chipotle's most recent 10-K noted that the company experienced a possible breach in 2004. That one cost about $4.3 million in losses and related expenses, it reported.

“Despite its 2004 data breach, Chipotle quite obviously failed to upgrade its data security systems in a meaningful way so as to prevent future breaches,” the complaint said.

“Defendant's public statements to customers after the data breach plainly indicate that defendant believes that card-issuing institutions should be responsible for fraudulent charges on cardholder accounts resulting from the data breach. Chipotle has made no overtures to the card-issuing institutions that are left to pay for damages as a result of the breach,” the complaint added.

In an April 25 statement addressing the breach, Chipotle said it had detected unauthorized activity on the network that supports its payment processing for purchases made in its restaurants.

“We immediately began an investigation with the help of leading cyber security firms, law enforcement, and our payment processor. We believe actions we have taken have stopped the unauthorized activity, and we have implemented additional security enhancements. Our investigation is focused on card transactions in our restaurants that occurred from March 24, 2017 through April 18, 2017. Because our investigation is continuing, complete findings are not available and it is too early to provide further details on the investigation,” it said.

Bellwether Community Credit Union Credit Union asked the court to, among other things, require Chipotle to use industry standard encryption of cardholder data at the point of sale, implement EMV technology, use third-party auditors to test its systems for weakness, train data security personnel about how to respond to a data breach and install manufacturer-recommended upgrades to its security software and firewalls.

As of March 31, 2017, Chipotle operated over 2,200 restaurants in the United States, as well as 34 international locations. It reported $3.9 billion in revenues in 2016. Its most recent 10-K notes that 70% of its 2016 sales were attributable to credit and debit card transactions.

“The risk of another such breach is real, immediate, and substantial,” the complaint said. “If another massive data breach occurs at Chipotle, plaintiff and members of the class will likely incur hundreds of millions of dollars in damage.”