NEW YORK (AP) — The New York attorney general says Dunkin' Donuts violated state law by not notifying almost 20,000 customers, including more than 2,000 in New York, about cyberattacks on their accounts in 2015 and inadequately warning more than 300,000 customers in 2018 about another attack.

Attorney General Letitia James announced a lawsuit Thursday against Dunkin' Brands, Inc.

The suit says the company knew in 2015 that a series of attacks had been made on customers' online accounts, with attackers able to steal money customers had stored for use at Dunkin' stores. But it says the company didn't inform the customers or fully investigate.

The suit says Dunkin' also kept customers in the dark about the full extent of 2018 cyberattacks.

An email seeking comment was sent to Dunkin' Brands Inc.