The restaurant chain, Chipotle Mexican Grill, seems pretty good at churning out huge numbers of huge burritos, but the company may need to revisit some basic corporate cybersecurity concepts.

Up until last week, anyone could have read email destined for the company’s HR department just by registering the domain “chipotlehr.com.” This is a security oversight and it was brought to light by an IT expert who discovered the bug after applying for a job. Chipotle says this is a non-issue, but currently Chipotle does not have a position that puts anyone in charge.

Chipotle May Understand how to Make a Burrito but they need Some Serious IT Help