Krispy Kreme Doughnuts

Summary

Krispy Kreme experienced a data breach that exposed personal information such as names, dates of birth, social security numbers, and financial account details of employees and, in some cases, their family members. The breach was allegedly carried out by the ransomware group Play, prompting a class‑action lawsuit that accused the company of failing to protect the data. Although the company denied wrongdoing, it agreed to a $1.6 million settlement that provides affected individuals with up to $3,500 for documented losses related to fraud or identity theft, or an alternative payment of about $75 without documentation, in addition to one year of credit monitoring. Claimants must submit a claim form by a set deadline to receive a monetary payout, while those who do not file a claim still receive the credit monitoring service.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 29, 2024, Krispy Kreme, Inc. detected unauthorized activity on a portion of its information technology systems and promptly initiated an investigation with leading cybersecurity experts. The company filed a Form 8‑K with the Securities and Exchange Commission on December 11, 2024, detailing the incident and noting that it had notified federal law enforcement. Krispy Kreme disclosed the breach to the public in December 2024, stating that it had begun containment and remediation efforts and had engaged additional cybersecurity firms to assess the scope and cause. A ransomware group known as Play later claimed responsibility for the attack and asserted that it had exfiltrated hundreds of gigabytes of data, a claim the company did not admit to but did not refute directly.

The compromised data included names, dates of birth, Social Security numbers, driver’s license numbers, health information, and financial account details of over 160,000 current and former employees; in some instances, information of employees’ family members was also exposed. Affected individuals received a Notice of the Data Incident that described the types of personal information that may have been impacted. While Krispy Kreme’s retail stores remained open and daily fresh deliveries to partners continued uninterrupted, the company reported operational disruptions, particularly with online ordering in parts of the United States, and anticipated that the incident would have a material impact on its results of operations and financial condition during the recovery period.

In response to the breach, Krispy Kreme engaged cybersecurity experts, cooperated with law enforcement, and maintained cybersecurity insurance expected to offset a portion of the incident‑related costs. A class‑action lawsuit was filed alleging inadequate protection of the stolen data, and the company ultimately agreed to a $1.6 million settlement without admitting wrongdoing. The settlement provides a two‑tier payout: individuals who can document losses from fraud or identity theft may receive up to $3,500, while those without documentation may receive an alternative cash payment of about $75, provided they submit a claim form by June 22, 2026. Eligible claimants must be U.S. residents who received the breach notice; they must also submit claims or opt‑out by June 6, 2026 to preserve their rights. All affected individuals are entitled to one year of free credit monitoring regardless of whether they file a claim, and payments will be distributed after the court’s final approval hearing scheduled for July 6, 2026.

Sources

Sources available to members: 6 sources.