11. Commitments and Contingencies Purchase Obligations We enter into various purchase obligations in the ordinary course of business, generally of a short-term nature. Those that are binding primarily relate to commitments for food purchases and supplies, amounts owed under contractor and subcontractor agreements, orders submitted for equipment for restaurants under construction, and marketing initiatives and corporate sponsorships. Data Security Litigation In April 2017, our information security team detected unauthorized activity on the network that supports payment processing for our restaurants, and immediately began an investigation with the help of leading computer security firms. We also self-reported the issue to payment card processors and law enforcement. Our investigation detected malware designed to access payment card data from cards used at point-of-sale devices at most Chipotle restaurants, primarily in the period from March 24, 2017 through April 18, 2017. The malware searched for track data, which may include cardholder name, card number, expiration date, and internal verification codes; however, no other customer information was affected. We removed the malware from our systems and continue to work to enhance our security measures. Substantially all of our investigation costs have been covered by insurance; however, we may incur legal and other expenses in excess of our insurance coverage limits associated with the data security incident in future periods. We will recognize these expenses as services are received. As a result of this incident, several lawsuits were filed alleging, among other things, that we negligently failed to provide adequate security to protect the payment card information of the plaintiff and other similarly situated customers. These lawsuits were consolidated into one action captioned Todd Gordon, et. al. v. Chipotle Mexican Grill, Inc., which was pending in the United States District Court for the District of Colorado. In March 2019, we reached an agreement to settle the consolidated Gordon action, and the court has granted preliminary approval of the settlement and the claims notification and administration process has commenced. We do not expect that the settlement will exceed applicable insurance coverages or will have a material financial impact on us, although the total liabilities arising from the settlement will be dependent in part on the number of claims filed, and may exceed our expectations and applicable insurance coverage. As of September 30, 2019, we had a balance of $ 21,365 for loss contingencies related to the data security incident on the condensed consolidated balance sheet, which is included in the accrued liabilities line item. We ultimately may be subject to liabilities greater or less than the amount accrued. Other Legal Proceedings Receipt of Grand Jury Subpoenas On January 28, 2016, we were served with a Federal Grand Jury Subpoena from the U.S. District Court for the Central District of California in connection with an official criminal investigation being conducted by the U.S. Attorneys Office for the Central District of California, in conjunction with the U.S. Food and Drug Administrations Office of Criminal Investigations. The subpoena required the production of documents and information related to company-wide food safety matters dating back to January 1, 2013. Since then we have received additional subpoenas requesting information related to illness incidents associated with several of our restaurants, and we may receive additional subpoenas in the future related to illness incidents at these or other restaurants. We have cooperated and intend to continue to cooperate in the investigation. Shareholder Class Actions On January 8, 2016, Susie Ong filed a complaint in the U.S. District Court for the Southern District of New York on behalf of a purported class of purchasers of shares of our common stock between February 4, 2015 and January 5, 2016. The complaint purports to state claims against us, each of the co-Chief Executive Officers serving during the claimed class period and the Chief Financial Officer under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, and related rules, based on our alleged failure during the claimed class period to disclose material information about our quality controls and safeguards in relation to consumer and employee health. The complaint asserts that those failures and related public statements were false and misleading and that, as a result, the market price of our stock was artificially inflated during the claimed class period. The complaint seeks damages on behalf of the purported class in an unspecified amount, interest, and an award of reasonable attorneys fees, expert fees and other costs. On March 8, 2017, the court granted our motion to dismiss the complaint, with leave to amend. The plaintiff filed an amended complaint on April 7, 2017. On March 22, 2018, the court granted our motion to dismiss, with prejudice. On April 20, 2018, the plaintiffs filed a motion for relief from the judgment and seeking leave to file a third amended complaint, and on November 20, 2018, the court denied the motion. On December 20, 2018, the plaintiff initiated an appeal to the U.S. Court of Appeals for the Second Circuit. We intend to continue vigorously defending the Ong case through any further appeals made by the plaintiff, but it is not possible at this time to reasonably estimate the outcome of or any potential liability from either of this case. Miscellaneous We are involved in various other claims and legal actions that arise in the ordinary course of business. We do not believe that the ultimate resolution of these actions will have a material adverse effect on our financial position, results of operations, liquidity or capital resources. However, a significant increase in the number of these claims, or one or more successful claims under which we incur greater liabilities than we currently anticipate, could materially and adversely affect our business, financial condition, results of operations and cash flows. Accrual for Estimated Liability Excluding the accrual for the Data Security Incident described above, we had a balance of $ 37,293 on the condensed consolidated balance sheet as of September 30, 2019, which is included in the accrued liabilities line item. We ultimately may be subject to liabilities greater or less than the amount accrued.