A web domain Chipotle Mexican Grill used in emails to potential employees for months had a big security problem: The company didn't own it. According to cybersecurity researcher Brian Krebs, people applying for positions with the company through its careers portal received automated emails back from "chipotle@chipotlehr.com." Except chipotlehr.com is not owned by Chipotle.