Inside Chipotle’s Contamination Crisis

Smugness and happy talk about sustainability aren’t working anymore.

By Susan Berfield | December 22, 2015

Photographs by Ted Cavanaugh
Chris Collins is a 32-year-old Web developer and photographer who lives in Oregon, just outside Portland. He and his wife are conscientious about their food: They eat organic, local produce and ethically raised animals. Collins liked to have a meal at Chipotle once a week. On Friday evening, Oct. 23, he ordered his regular chicken bowl at his usual Chipotle in Lake Oswego. His dinner was made of 21 ingredients, including toasted cumin, sautéed garlic, fresh organic cilantro, finely diced tomatoes, two kinds of onion, romaine lettuce, and kosher salt. It tasted as good as always.

By the next night, Collins’s body was aching and his stomach was upset. Then he began experiencing cramping and diarrhea. His stomach bloated. “Moving gave me excruciating pain,” he says, “and anytime I ate or drank it got worse.” His diarrhea turned bloody. “All I was doing was pooping blood. It was incredibly scary.” After five days, he went to an urgent-care clinic near his home; the nurse sent him to an emergency room. He feared he might have colon cancer.

On Halloween, the ER doctor called him at home: Collins had Shiga-toxin-producing E. coli 026, and he’d likely gotten it from one of those 21 ingredients in his meal at Chipotle. (This was later confirmed by public-health officials.) The doctor warned him that kidney failure was possible; intensive treatment, including dialysis, could be necessary. His kidneys held up, but it took an additional five days for the worst of Collins’s symptoms to ease and nearly six weeks for him to recover. He still doesn’t have as much physical strength as he used to, and he feels emotionally shaky, too. “Before, I was doing the P90X workouts. For a long time after, I couldn’t even walk a few blocks,” he says. “It made me feel old and weak and anxious.” On Nov. 6, Collins sued Chipotle, seeking unspecified damages.

Featured in Bloomberg Businessweek, Dec. 28, 2015. Subscribe now.

Collins was among 53 people in nine states who were sickened with the same strain of E. coli; 46 had eaten at Chipotle in the week before they fell ill. Twenty got sick enough to be hospitalized, according to the Centers for Disease Control and Prevention. “I trusted they were providing me with ‘food with integrity,’ ” Collins says, sarcastically repeating the company motto. “We fell for their branding.” Chipotle’s public stance during the outbreak irritated him, too. The company closed all 43 of its restaurants in Oregon and Washington in early November to try to identify the source of the E. coli and sanitize the spaces. Notices on restaurant doors generally referred to problems with the supply chain or equipment. But local media reported that at least one restaurant in Portland put up a note that said, “Don’t panic … order should be restored to the universe in the very near future.” “That felt so snarky,” Collins says. “People could die from this, and they were so smug.”

For a long time, smug worked pretty well for Chipotle Mexican Grill. It’s grown into a chain of more than 1,900 locations, thanks in part to marketing—including short animated films about the evils of industrial agriculture—that reminds customers that its fresh ingredients and naturally raised meat are better than rivals’ and better for the world. The implication: If you eat Chipotle, you’re doing the right thing, and maybe you’re better, too. It helped the company, charging about $7 for a burrito, reach a market valuation of nearly $24 billion. Its executives seemed to have done the impossible and made a national fast-food chain feel healthy.

Fewer people associate Chipotle with “healthy” now. Three months before Collins was infected with E. coli, five people fell ill eating at a Seattle-area restaurant. By the time local health officials had confirmed a link, the outbreak was over, so no one said anything. In August, 234 customers and employees contracted norovirus at a Chipotle in Simi Valley, Calif., where another worker was infected. Salmonella-tainted tomatoes at 22 outlets in Minnesota sickened 64 people in August and September; nine had to be hospitalized. Norovirus struck again in late November: More than 140 Boston College students picked up the highly contagious virus from a nearby Chipotle, including half of the men’s basketball team. An additional 16 students and three health-care staff picked it up from the victims. The source? A sick worker who wasn’t sent home although Chipotle began offering paid sick leave in June. In the second week of December, when Chipotle should have been on highest alert, a Seattle restaurant had to be briefly shut down after a health inspection found that cooked meat on the takeout line wasn’t being kept at a high enough temperature. And in the most recent case, on Dec. 21, the CDC announced it was investigating an outbreak of what seems to be a different and rare version of E. coli 026 that’s sickened five people in two states who ate at Chipotle in mid-November. The company says it had expected to see additional cases. It still doesn’t know which ingredients made people ill.

Almost 500 people around the country have become sick from Chipotle food since July, according to public-health officials. And those are just the ones who went to a doctor, gave a stool sample, and were properly diagnosed. Food-safety experts say they believe with any outbreak the total number of people affected is at least 10 times the reported number. The CDC estimates that 48 million Americans get sick from contaminated food every year.

At Chipotle, three different pathogens caused the five known outbreaks. That wasn’t inevitable or coincidental. “There’s a problem within the company,” says Michael Doyle, the director of the center for food safety at the University of Georgia. Chipotle has gotten big selling food that’s unprocessed, free of antibiotics and GMOs, sometimes organic, sometimes local. “Blah, blah, blah,” says Doug Powell, a retired food-safety professor and the publisher of barfblog.com. “They were paying attention to all that stuff, but they weren’t paying attention to microbial safety.” Whatever its provenance, if food is contaminated it can still make us sick—or even kill. Millennials may discriminate when they eat, but bacteria are agnostic.

“Food with integrity,” a promise to Chipotle’s customers and a rebuke to its competitors, has become the source of much schadenfreude among both. Chipotle’s stock has lost about 30 percent of its value since August. Sales at established stores dropped 16 percent in November, and executives expect a decline of 8 percent to 11 percent in comparable-store sales for the last three months of the year. That would be the first quarterly decline for Chipotle as a public company.

Steve Ells, Chipotle’s founder and co-chief executive, went on the Today show on Dec. 10, apologized to everyone who’d fallen ill, and announced a comprehensive food-safety program that he said would far exceed industry norms. He didn’t address why a company that had challenged quality standards with such gusto hadn’t taken on safety standards as well. Chipotle has said it will shift more food preparation out of restaurants and into centralized kitchens—that is, it will do things more like the fast-food chains it’s long mocked. Ells’s company has always urged customers to think about its supply chain. Well, now they are.

Six weeks after the first E. coli victims in the Pacific Northwest got sick and about a week after Ells’s Today appearance, Chipotle placed a full-page ad, signed by him, in newspapers across the country. “The fact that anyone has become ill eating at Chipotle is completely unacceptable to me, and I am deeply sorry,” he wrote. “As a result, we are committed to becoming known as the leader in food safety, just as we are known for using the very best ingredients in a fast-food setting.” Ells was in Seattle by then. During interviews he carefully followed the new standard thinking on corporate crisis management: Overapologize and then pivot to the cheery future.

On Dec. 17, speaking by phone in New York, he’s still on message, describing the Seattle restaurants he visited as clean and organized. “I ate delicious food there,” he says. “Traffic was slow, but we’re ready for people to come back. There is no E. coli in Chipotle. ” To hear Ells tell it, the company is witnessing an outbreak of excitement. He says the chain’s suppliers are excited to participate in the new safety programs; employees at headquarters in Denver are excited to contribute however they can; it’s “a very, very exciting time for us to be pushing the boundaries” on food safety. “We’re embracing this as an opportunity.”

Ells studied art history in college, trained as a chef at the Culinary Institute of America, and opened the first Chipotle in Denver in 1993 with a loan from his father. He set up a model—open kitchen, fresh ingredients, real cooking in the back, and an assembly line in front, allowing customization and speed—that’s become its own industry standard. Chipotle grew from 489 restaurants and revenue of $628 million in 2006, when it went public, to about 1,800 restaurants and $4.1 billion in revenue in 2014. Net profit increased 60 percent from 2012 to 2014. Ells and his co-CEO, Montgomery Moran, together earned more than $140 million in total compensation during that time. And Michael Pollan, the good-food arbiter, said that Chipotle was his favorite fast-food chain and that he didn’t have a second.

The company was influenced in ways it doesn’t always admit by the biggest, most industrialized chain of them all: McDonald’s. The company invested about $340 million in Chipotle from 1998, when it had 13 restaurants in Colorado, until 2006, when the two parted ways. McDonald’s taught Chipotle supply-chain economics. Chipotle often derides fast-food chains and their factory farms, enlisting the likes of Willie Nelson to make plaintive music videos about crop chemicals and steroidal cattle. But Ells respects McDonald’s size. In an interview with Bloomberg in 2014, he said Chipotle could one day be “bigger than McDonald’s in the U.S. I mean, that’s not an unreasonable way to think about this.”

The companies shared distribution centers and processing facilities, and in some cases they still do. Chipotle calls these facilities commissaries. They’ll play an increasingly important role as more food prep is shifted to these centralized kitchens. When I ask who else uses them, Ells, leery of invoking the competition, says: “I don’t know if I know their other customers. I can see what you could make of this. It’s nothing.”

Chipotle, like any chain its size, has infrastructure it doesn’t always want to fully reveal. McDonald’s has a System. Chipotle does, too. It has about 100 suppliers for its 64 ingredients. That doesn’t include local farms—those within 350 miles of a restaurant—which at peak season supply only 10 percent of its produce.

Executives will identify a few suppliers: Chipotle has for 15 years bought pork for its carnitas from Niman Ranch, where pigs are raised outdoors or in pens that are “deeply bedded.” The company website features Tom Kearns, a Wisconsin dairy farmer, as a symbol of its support for family farms. But most suppliers go unnamed. Why? “This is not something we generally provide,” Chipotle spokesman Chris Arnold said in an e-mail.

Nor does Chipotle generally provide the names of its distributors or commissaries. But it will confirm them if asked. Chipotle’s pork and beef are braised at OSI Group and Ed Miniat Inc., outside Chicago; Ready Foods in Denver cooks its beans and makes its red and green salsas. The companies don’t talk about their other clients, but on its website, OSI calls itself “a global leader in supplying value-added protein items” and other foods to large brands. John Knight, a restaurant consultant who worked with Chipotle from 2009 to 2011, describes these commissaries as high-end. “Chipotle uses the ones that do food for cruise ships and casinos,” he says. “They’re not making hospital, school, or jail food.” Ells, ever wary of protecting Chipotle’s image, notes that he taught the chefs in these commissaries to cook food the way he would.

MILLENNIALS DISCRIMINATE; BACTERIA ARE AGNOSTIC

The source, or sources, of E. coli were somewhere in that supply chain. Because restaurants from Oregon to New York served contaminated food, the problem most likely originated with one of Chipotle’s big suppliers, not one of the local farms. E. coli is spread through human and animal feces. The harmful microbes can be transmitted to crops in irrigation water, or if animals are allowed to defecate in the fields, or if manure isn’t properly treated. Cooking food long enough at high enough temperatures or properly sanitizing it kills E. coli. Hard-to-clean produce that’s eaten raw is considered high-risk. At Chipotle that’s the tomatoes, lettuce, and cilantro—in other words, the same stuff that gives Chipotle its fresh-tasting advantage.

The CDC says Chipotle has been very cooperative in the E. coli investigation, but that the company is having trouble telling the agency which batches of ingredients went to which stores at which times. “The system they have is not able to solve the problem we have at hand. It’s not granular enough,” says Ian Williams, chief of the CDC’s outbreak response and prevention branch. He notes that “traceability from the farm to the point of service” should be improved throughout the food industry. In recent years, the agency has been able to find the contaminated ingredients in fewer than half of all multistate outbreaks. Without a conclusion to the investigation, some customers’ unease about returning to Chipotle could be prolonged. Ells prefers to see the uncertainty as another opportunity. “The silver lining is that it has forced us—not forced us, caused us—to take a rigorous look at every ingredient.” Couldn’t Chipotle have done that anyway? “Yes, that’s true.”

Data: Centers for Disease Control and Prevention; National Institutes of Health; New York Times; BillMarler.com

The spread of norovirus in Simi Valley and Boston was caused by breaches of protocol, Ells says. Those protocols were established at Chipotle in 2008 after a norovirus outbreak sickened 500 people near Kent State University, in Ohio. Norovirus, which is highly contagious, is the leading cause of illness from contaminated foods, affecting as many as 21 million people in the U.S. every year. Its symptoms, including diarrhea, vomiting, and stomach pain, usually last a couple of days. It’s a problem on cruise ships and in other enclosed places; in Britain it’s known as the winter vomiting bug. The Boston College outbreak occurred as students were preparing for finals. Health services helped care for the sick students, and the dining hall staff prepared special meal packs for them. The facilities crews disinfected every common area on campus.

In late October, Chipotle hired Mansour Samadpour, head of IEH Laboratories & Consulting Group in Seattle, to put together a more aggressive food-safety plan, which they hope will bring the risk of contamination to near zero. Samadpour describes his lab as a privately financed public-health organization. “Being in compliance with industry standards is less than 5 percent of what companies need to do to make food safe,” he says. “Company after company finds that out after they have events.”

Samadpour recommended changes at every step of Chipotle’s system. More food will be prepared ahead of time, out of sight at commissaries, and transported to 19 distribution centers and then to more than 1,900 restaurants. Samadpour calls it an “industrial-strength plan,” a term Ells and other executives use, too. This won’t turn Chipotle into McDonald’s, but it could make for some awkward marketing. “They’re sort of in a bind,” says Christopher Muller, a professor of hospitality at Boston University. “They want to have this local, fresh image, and making food in a commissary and shipping it all over the country takes away from that.”

Before it’s harvested, produce will be screened for pathogens in small batches using what Chipotle calls high-resolution DNA-based tests. Meeting these higher standards will be expensive for smaller farms: There’s the cost of the testing itself and of discarding rejected vegetables and herbs. “Will everybody be able to afford it right away? No,” Ells says. “Will we help? We will. Is it going to work everywhere? Maybe not.” Chipotle’s chief financial officer, Jack Hartung, is more direct. “We like the local program, we think it’s important, but with what’s just happened we have to make sure food safety is absolutely our highest priority,” he says. “If it’s testing and safety vs. taking a step backward on local, we would do that and hope it would be temporary.”

If produce passes the initial tests, it will be sent to the commissaries, where it will be washed, sanitized, and retested. The commissaries, rather than the restaurants, will be responsible for cleaning and packaging the cilantro, shredding the lettuce, and dicing the tomatoes.

A single Chipotle restaurant uses about five cases of tomatoes a day. Employees used to dice the tomatoes by hand in the restaurants. When that became too demanding a task, Ells introduced food processors, but he wasn’t happy with the results. He moved the dicing to a centralized kitchen. He won’t say where. Two years ago, Chipotle bought food processors that could dice tomatoes in its kitchens just as well as the commissaries could and better retain their flavor. But now, post-E. coli, the tomatoes will again arrive at the restaurants diced, packaged, and tested for pathogens. “If you ate the tomato on its own, could you tell the difference? Maybe,” Ells says. “But I challenge you to tell the difference in a burrito.” Ells says the tomatoes themselves will be the same, but the cuts will be cleaner and more consistent. Still, he says, “it is my desire that one day we can do it in-house again. There’s no method of testing that makes that possible now.”

Commissaries have been preparing a portion of Chipotle’s meat from the early days. It was never practical or efficient to braise meat in Chipotle’s small kitchens. The barbacoa and carnitas are vacuum-packed and cooked sous vide, in a temperature-regulated bath. Then they’re sent to regional distribution centers and on to the restaurants. Steak and chicken arrive raw in the restaurants and are marinated in an adobe rub, then grilled. The new protocols require changes to how the meat is marinated to prevent cross-contamination.

In the restaurants, workers will add cilantro to higher-temperature rice. “That’s a kill step,” Samadpour says. They’ll blanch avocados, onions, jalapeños, lemons, and limes for 5 to 10 seconds in boiling water. That will destroy any microbes on the surface. Lemon and lime juice will be added earlier to the salsa and guacamole to reduce the microbe count. “And guess what?” Ells asks. “It turns the salsa a brighter red and gives a sweeter taste.” Any suggestion that these tweaks might together cause a noticeable change in taste for the worse is dismissed. “It’s the genius of ‘and,’ ” Ells says. “We’re doing both: great ingredients and the safest place.” Hartung, the CFO, has his own way of conveying that idea: “We want to have our cake and eat it, too.”

The Chipotle assembly line is a marvel of efficiency, and Ells often speaks of it in a way that would make a McDonald’s executive proud. “We all think about the Chipotle line. ... How do you do it faster?” he said in his 2014 interview with Bloomberg. “Throughput is something that we always will have to think about. Faster, faster, faster, faster.” Throughput is the unappetizing way fast-food restaurants talk about serving their customers when their customers aren’t listening. On the most efficient Chipotle lines, customers get their food in less than two minutes, says Knight, the restaurant consultant. Most other fast-casual chains take from four to six minutes. Arnold, Chipotle’s spokesman, says fast locations “process more than 300 transactions per hour during peak hours.”

An alarm goes off every hour in every Chipotle restaurant, to remind workers to wash their hands and put on new latex gloves. But three former managers, who asked to remain anonymous to speak openly about their former employer, said the alarm was often ignored when the restaurants were busy. Field managers came by every month or so, and for a few days afterward employees observed the hand-washing rule, says a former manager, who worked in a restaurant outside San Francisco. Then they’d slack off again. He also notes that Chipotle put more emphasis on the safe handling of meat than produce. Another former manager, from Arizona, says Chipotle assumed the speed and skill of seasoned culinary workers, while her restaurant was staffed mostly by young employees on their first job. Arnold says new employees aren’t expected to work as efficiently as more experienced ones.

Chipotle opened 192 restaurants in 2014 and expected to open 215 to 225 in 2015. The company held its first National Career Day on Sept. 9. The goal was to hire 4,000 employees, increasing its staff by 7 percent. That sounds like a public-relations coup and a human resources nightmare. Were some of Chipotle’s safety problems a result of growing too fast? “I can understand linking the two, but I don’t think the growth rate is the cause of the problem,” Hartung says. “The standard procedures worked for a long time. We hadn’t had outbreaks since 2009. We’re not going back and saying let’s train them to do better. We’re training them to do something different.”

No one at Chipotle has publicly estimated the cost of the safety programs it’s putting in place. “Very, very expensive,” is as close as Ells comes. “Right now we’re not trying to make this cost-effective. We’re just doing it,” Hartung says. “We’re likely to do it very inefficiently.” When asked at an investor conference if he’d consider raising prices or decreasing portions to cover some of the expense, he said: “That would be tacky.” He did note, though, that eventually Chipotle might raise prices, and “instead of investing that in food integrity, we might have to invest that in food safety.” In the meantime, he says profits and the profit margin will be messy. The company is also facing at least seven lawsuits, the most recent filed by a mother whose son was infected with norovirus in Boston. He’s still recovering. Chipotle says it doesn’t comment on pending legal actions, but in incidents such as these its aim is to make things right with customers.

Chipotle isn’t giving any estimates for 2016 at all, except to say that 220 to 235 restaurant openings will proceed. When I ask Ells if they’ve considered scaling back, he says: “Not at all. It never entered our minds.”

Chipotle was already experiencing slower growth in established stores. Comparable-store sales rose 16.8 percent in 2014; during the first nine months of 2015, that figure was 5.5 percent. Hartung says there have been surges and slowdowns before. “Nothing signaled to us that we were at a peak,” he says. “We were just taking a pause.” Yet it’s natural for a company that’s been around for two decades to shift to more modest growth.

It’s worth noting that, contaminated food aside, Chipotle is on the right side of fresh food trends, while its more old-school rivals stumble. But the company’s pause could be extended. Mark Crumpacker, the chief creative and development officer, saysChipotle has seen a drop-off among its least frequent customers and its most frequent. “That’s more worrying,” he says. Chipotle may have lost some customers altogether. “A small percentage may never come back, or it may take years.”

Confidence has taken the company far. It may have gotten Chipotle into this mess; it may help get it out. Crumpacker says he has plans for advertising next year on radio, in print, online, and through direct mail. “It won’t be, ‘Come to the safest place to eat,’ ” he says. “Hopefully, it will be humorous to the extent that’s appropriate.” But he knows how great the challenge is. “There’s nothing worse from a trust perspective. This is not the kind of problem that you market your way out of.”