In September 2019, the New York attorney general alleged in a lawsuit that Dunkin' mishandled a series of "brute force" cyberattacks that were directed at customers using the Dunkin' mobile app. These attacks took place in early 2015 and thousands of usernames and passwords stolen. The state lawsuit alleges that Dunkin' employees knew about these attacks, but failed to take appropriate action. The New York Attorney General Letitia James alleges the Massachusetts-based company "glazing over" the cyberattacks. A Dunkin' spokesperson said the restaurant chain has been working with law enforcement for two years and will fight the lawsuit.