HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICCREDENTIALSLowContained
Dunkin' Brands, Inc.
bd_39f99b715c47b376 · schema v1 · pii pii-v1
Full breach record for Dunkin' Brands, Inc. →Dunkin' Brands Inc. notified customers that third parties used credentials stolen from other companies' breaches to attempt to log into DD Perks accounts. The company learned of the attempts on October 31, 2018. Affected data may include names, email addresses, and account numbers. Dunkin' forced password resets and replaced stored value cards.
California clockDiscovered Oct 31, 2018 → Notified Nov 28, 201828d ✓ CA 60-day OK28 days discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_995919194e620836South Carolina State AGfiled 2018-11-28Verified
- bd_e599e179e50000e1Montana State AGfiled 2018-11-28Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-142192
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 28, 2018
- Raw hash
- 73307aa4c8c154882e98d4c6962f4e74ebaf4cb900acffdef0f3cd21fe067b49
Reporting entity
- Name
- Dunkin' Brands, Inc.norm: dunkin brands
Victim entity
- Name
- Dunkin' Brands, Inc.norm: dunkin brands
Incident
- Discovered
- Oct 31, 2018
- Materiality determined
- —
- Notification sent
- Nov 28, 2018
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Reported the incident to law enforcement
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 28d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 31, 2018→ Notified: Nov 28, 201828d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.