The Dunkin’ Donuts data breach settlement was a September 2020 enforcement action by the New York Attorney General against Dunkin’ Brands, Inc. It required the company to pay $650,000 in penalties and costs to New York State, reset compromised passwords, notify affected customers, and refund unauthorized charges on stored-value DD cards.1New York State Office of the Attorney General. Attorney General James Gets Dunkin’ to Fill Holes in Security, Reimburse Hacked Customers It was not a class action, there is no open claim form, and the 90-day window customers had to report fraudulent charges closed in late 2020 or early 2021.
What the Breach Was
Between 2015 and early 2019, Dunkin’ was hit by a series of credential stuffing attacks. Attackers took usernames and passwords stolen from unrelated breaches at other companies and tested those combinations against Dunkin’ accounts. Because many people reuse passwords, a lot of them worked.
The first wave, around August 2015, compromised roughly 19,715 customer accounts. A much larger wave between October 2018 and January 2019 affected approximately 300,000 accounts.2New York State Office of the Attorney General. Proposed Consent Order and Judgment – People of the State of New York v. Dunkin’ Brands, Inc. More compromised accounts turned up in early 2020.
Once in, attackers could see names, email addresses, and DD Perks details, and could drain the stored-value DD cards linked to accounts. The Attorney General’s investigation found Dunkin’ had been alerted to the attacks by its own security vendor but did not act quickly to protect or notify customers. Under New York General Business Law Section 899-aa, businesses must notify affected New York residents within 30 days of discovering a breach involving private information, including a username or email combined with a password.3New York State Senate. New York General Business Law 899-AA – Notification; Person Without Valid Authorization Has Acquired Private Information
Why It Wasn’t a Class Action
This distinction is the one most people get wrong. A class action is brought by private plaintiffs on behalf of a group, usually with a settlement fund, claim forms, and a court-appointed claims administrator. The Dunkin’ matter was an enforcement action filed by the New York Attorney General under the state’s consumer protection authority. The $650,000 went to the state as penalties and costs, not into a fund distributed to individuals.1New York State Office of the Attorney General. Attorney General James Gets Dunkin’ to Fill Holes in Security, Reimburse Hacked Customers
Refunds were handled directly between Dunkin’ and each affected customer. There was no claims administrator, no settlement website, and no flat “cash payment” for people without documented losses. The settlement also did not include company-paid credit monitoring or identity theft protection.
Who Was Covered and What They Got
Only New York residents were covered. The consent order defined eligible customers by when their accounts were compromised: the 2015 wave (about 19,715 accounts), the 2018–2019 wave (about 300,000), unauthorized access identified between January and April 2020, and roughly 4,800 additional accounts identified by the Attorney General’s office in February 2020.2New York State Office of the Attorney General. Proposed Consent Order and Judgment – People of the State of New York v. Dunkin’ Brands, Inc.
Within 30 days of the consent order, Dunkin’ had to reset the password on every eligible account with a linked DD card and send notifications by mail and email explaining what had happened and how to request account records. Customers with a linked stored-value card could then request their account history and report unauthorized transactions. Dunkin’ had to provide those records within three business days and issue refunds for confirmed unauthorized charges. The company could not deny a refund solely because the customer lacked their own documentation; it had to review the account itself.
The contact points the consent order specified were (800) 447-0013 and customerservice@dunkinbrands.com.
Can You Still Claim Anything?
Eligible customers had 90 days from the notification date to contact Dunkin’ and report unauthorized activity. Because notifications went out within 30 days of the September 2020 consent order, that window closed in late 2020 or early 2021. The settlement no longer provides a direct path to a refund.
A few possibilities remain. If Dunkin’ issued you a refund check that was never cashed, the money may have been turned over to your state’s unclaimed property program. Every state runs a free search of unclaimed funds by name; New York residents can use the state comptroller’s unclaimed funds portal, and residents of other states can search their own state treasury or comptroller website.
If you believe your account was compromised and you never received a notification or resolution, you can still contact Dunkin’ customer service and file a complaint with your state attorney general’s office. Those steps sit outside the consent order’s formal refund process, but they remain available.
One boundary worth naming: the consent order covered New York residents. If you lived elsewhere, this particular action did not create rights for you, though your own state’s breach notification law may have.
How to Avoid Being Caught in the Next One
Credential stuffing works because people reuse passwords. Dunkin’s systems were not directly hacked; attackers used credentials stolen from other companies and tried them at Dunkin’. The same technique gets used against loyalty programs, streaming services, and any account tied to a payment method.
Use a unique password for every account, especially anything linked to a card or stored value. A password manager makes that manageable. Turn on two-factor authentication wherever it is offered; it defeats credential stuffing even when the password has leaked. Check transaction history on loyalty and stored-value accounts the same way you check a bank account, because those accounts are targets precisely because people forget them.
If you spot unauthorized transactions, report them to the company right away and file a complaint with your state attorney general’s office. New York’s 30-day notification rule under GBL 899-aa applies to companies that discover a breach, and most states have similar laws with their own timelines, but the Dunkin’ case shows that compliance is not automatic.3New York State Senate. New York General Business Law 899-AA – Notification; Person Without Valid Authorization Has Acquired Private Information Watching your own accounts is still the most reliable safeguard.