New York Sues Dunkin’ Donuts Over Cyberattacks

The parent of Dunkin’ Donuts was sued on Thursday by New York Attorney General Letitia James, who accused the chain of failing to protect hundreds of thousands of customers whose accounts were targeted in a series of “brute force” cyberattacks.

James said Dunkin’ Brands Group Inc did nothing in 2015 to protect 19,715 customers whose accounts had been targeted in a single five-day period, after learning about the problem from its own app developer.

She said the Canton, Massachusetts-based company failed to notify affected customers of the breaches, reset their passwords or freeze their Dunkin’ Donuts cards.

James also said Dunkin’ failed to adopt appropriate safeguards to limit future attacks, despite customer reports of continuing fraud on their accounts.