Dunkin' Brands

Disclosed Sep 26, 2019Settled

Credential stuffing hit tens of thousands of accounts; USD 650,000 NY AG settlement

New York sued Dunkin' in 2019 for failing to respond to credential stuffing attacks that compromised tens of thousands of customers' online accounts and stored value cards. The 2020 settlement required notification, password resets, refunds and USD 650,000 in penalties and costs.

What is known

People affected	Not stated in the sources we have
Disclosed	Sep 26, 2019
Attack	Credential stuffing
Data exposed	Credentials and tokensPayment cards
Sector	Retail · US
Status	Settled
Lawsuit or fine	USD 650,000 NY AG settlement (Sept 2020) (about $650K)

Sources

Regulatorag.ny.gov

NY AG: AG James sues Dunkin' Donuts over cyberattacks

Regulatorag.ny.gov

NY AG: Dunkin' to fill holes in security, reimburse hacked customers

Notices filed

TotalSep 26, 2019

ResearchCount not stated

Other breaches at Dunkin' Brands

Breach, details not statedExposed names, payment cards and financial details. Reported to the California AG.175K affectedRetailUSNov 28, 2018

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Dunkin' Brands