Krispy Kreme notifies 160,000 individuals impacted by data breach

Krispy Kreme has started the process of notifying a significant number of individuals impacted by a data breach that occurred towards the end of 2024. The company revealed that over 160,000 people, which includes current and former employees and their families, have been affected by the breach. This disclosure comes as part of Krispy Kreme’s ongoing investigation into the cyber incident, which has prompted the company to reach out to those impacted.

In a statement posted on its website and a formal submission to the attorney general’s office in Maine, Krispy Kreme confirmed that 161,676 individuals had their personal information exposed as a result of the breach. The compromised data varies on a case-by-case basis but includes a wide range of sensitive information such as names, dates of birth, Social Security numbers, driver’s license or state ID numbers, email addresses, financial account details, credit card information, passport numbers, and even biometric data among others.

The unauthorized access that led to this breach was the result of a hacking incident that Krispy Kreme first became aware of in late November 2024. This cyber attack resulted in disruptions to the company’s operations and caused Krispy Kreme to incur significant expenses. In its annual report submitted to the U.S. Securities and Exchange Commission, Krispy Kreme disclosed that it spent around $3 million on remediation efforts in the fourth quarter of 2024 and estimated a revenue loss of $11 million in the U.S. as a direct consequence of the breach.

Looking ahead, the company anticipates additional costs throughout fiscal year 2025 related to the incident, including operational challenges in the early stages of the first quarter, fees for cybersecurity experts and advisors, and other associated expenses. However, Krispy Kreme does have cybersecurity insurance in place to help mitigate some of these financial losses. Although details of the breach itself have not been disclosed, Krispy Kreme stated that there is no evidence to suggest that the compromised information has been misused. Additionally, the company has not received any reports of identity theft or fraud resulting directly from the incident.

Krispy Kreme has taken necessary steps to fortify its systems following the breach and is actively working to enhance the security of its infrastructure to safeguard the privacy of the data it holds. As part of its response to the breach, Krispy Kreme is offering free credit monitoring and identity protection services to affected individuals. Those impacted are strongly advised to closely monitor their financial accounts and credit reports for any unusual activity or signs of unauthorized access.