Dunkin' Brands

Disclosed Nov 28, 20187 years ago175,221 affectedConfirmed

Official notice

What is known

People affected	175,221 (as reported by the organization)
Disclosed	Nov 28, 2018
Discovered	Jan 10, 2019
Attack	Not stated
Data exposed	Names, Payment cards, Financial
Sector	Retail · US
Status	Confirmed

Sources

Source	Kind
California Attorney General breach notice: Dunkin' Brandsoag.ca.gov · Official notice	Official notice
Indiana Attorney General 2018 data breach report: Dunkin Brandsin.gov · Official notice	Official notice
Maine Attorney General breach notice archive: Dunkin' Brandsmaine.gov · Official notice	Official notice

Notices filed

Where	Filed	People
California AGresidents of CA	Nov 28, 2018
Indiana AGresidents of IN	Nov 28, 2018	2,118
Maine AGresidents of ME	Nov 28, 2018	2,857
Maine AGresidents of ME	Feb 8, 2019	32

Other breaches at Dunkin' Brands

Breach	Disclosed	Attack	Sector	Status	Affected
Credential stuffing hit tens of thousands of accounts; USD 650,000 NY AG settlementSep 26, 20197 years agoCredential stuffing	Sep 26, 20197 years ago	Credential stuffing	Retail	Settled	Unknown

History of this record

2026-09-25 · data_types: [] to ["names","payment-card","financial"] · backfill source
2026-09-25 · discovered: empty to 2019-01-10 · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 175221 · backfill source
2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Dunkin' Brands

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.