NEW YORK (AP) — Dunkin’ Donuts failed to notify almost 20,000 customers across the U.S. about cyberattacks on their accounts in 2015 and inadequately warned more than 300,000 customers about another hacking attack in 2018, New York’s attorney general said in a lawsuit announced Thursday.
“Dunkin’ failed to protect the security of its customers,” Attorney General Letitia James said in a statement. “And instead of notifying the tens of thousands impacted by these cybersecurity breaches, Dunkin’ sat idly by, putting customers at risk.”
According to the lawsuit, filed in state Supreme Court in Manhattan, the company knew in 2015 that a series of attacks had been made on customers’ online accounts, with attackers able to steal money customers had stored for use at Dunkin’ stores. But it said the company didn’t inform the customers or fully investigate.
The suit also accuses Dunkin’ of keeping customers in the dark about the full extent of 2018 cyberattacks, by only intimating attempts had been made to access accounts but not that accounts had been breached.
