Krispy Kreme data breach: what happened and what to do

What Krispy Kreme has said about the incident

The first public statement came in a filing with the Securities and Exchange Commission. According to Krispy Kreme's Form 8-K, the company was notified on November 29, 2024 of "unauthorized activity on a portion of its information technology systems." It said it began investigating, containing and fixing the problem with outside cybersecurity experts, and that it had notified federal law enforcement.

The filing also said online ordering was disrupted in parts of the United States, while shops stayed open. It said the full scope, nature and impact of the incident were not yet known. It did not say whether data had been accessed or stolen.

That is worth pausing on. Krispy Kreme has not described what kind of attack it was in the documents I read. The Record reported that the Play ransomware group claimed the attack in December 2024. That is the group's claim. The company has not been quoted confirming it, so this article does not treat it as established.

The personal data question came later. In its notice letter, as filed with the California Attorney General, Krispy Kreme says that on May 22, 2025 it determined that certain personal information was impacted. The letter adds that there is no evidence the information was misused and that the company is not aware of reports of identity theft or fraud as a direct result of the incident.

Who may be affected

Insurance Journal reported that Krispy Kreme's notice to the Maine Attorney General listed 161,676 people, and The Record gives the same number. I could not open the Maine page myself, so that number comes from press coverage of the filing.

According to The Record, a company spokesperson said the vast majority are Krispy Kreme employees, their family members and former employees. Some other news stories describe customers. The sources do not line up perfectly on this, so do not assume that buying a doughnut put you on the list.

The reliable way to find out is the company's own channel. If you received a "Notice of Data Breach" letter, it lists a phone line for questions, (866) 461-2984, open Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time, and asks you to have your membership number ready. Never use a number or link from a message you did not ask for.

What data was involved

The notice letter leaves the exact list to each recipient. The sample filed in California has a blank where the data elements go. The data varies by person.

Insurance Journal's summary of the notice lists categories that varied by person. They include names, dates of birth, Social Security numbers, driver's license or state ID numbers, financial account information, passport numbers, health insurance information and more. Treat this as the range of what some people were told, not as a list that applies to everyone.

If your letter names your Social Security number or a bank account, take the steps below more seriously. If it names less, you can still do the basics.

What to do now

Start with the free monitoring, if you were offered it. The sample letter says Krispy Kreme is offering identity monitoring through Kroll at no cost, including credit monitoring, fraud consultation and identity theft restoration. You activate it at the Kroll enrollment address in your letter, using the membership number printed on it, before the deadline in your letter. The length of the term and the deadline are filled in per person.

Next, consider a credit freeze. The FTC says a credit freeze is free, blocks new credit from being opened in your name until you lift it, and lasts until you lift it. You place it with each of the three bureaus: Equifax, Experian and TransUnion. The FTC also describes an initial fraud alert that lasts one year and can be renewed. A fraud alert does not block anything. It asks businesses to check with you before opening new credit.

Then change passwords and turn on multi-factor authentication. The FTC advises changing the password for the affected company and for any account where you used something similar. A password manager can make unique passwords easier. The FTC says multi-factor authentication helps protect an account even if the password is exposed.

Finally, watch your accounts. The sample letter recommends reviewing account statements and credit reports for activity you do not recognize. The FTC says IdentityTheft.gov is where you report misuse and get a recovery plan if someone is opening accounts or making purchases with your information.

Watch for scam messages that follow a breach

After a breach becomes public, scammers sometimes send messages that mention it. The FTC lists common phishing signs: unexpected messages claiming an account or payment problem or asking you to confirm personal or financial details. It also says legitimate companies will not email or text a link to update your payment information.

Its advice is simple. Do not click links or open attachments in messages you did not expect. Contact the company using a phone number or website you know is real. Forward phishing emails to reportphishing@apwg.org, forward texts to 7726, and report the attempt to the FTC at ReportFraud.ftc.gov.

If an email or text claims to be about the breach and asks you to log in or pay, treat it as suspect and verify it separately.

The class action settlement

A class action over the incident, In re: Krispy Kreme Data Security Litigation, was filed on June 20, 2025, according to ClassAction.org. The site reports a $1,616,760 settlement. It says class members who filed a valid claim could choose reimbursement for documented losses or a flat payment, with both amounts subject to adjustment depending on the number of claims. It lists the claim deadline as June 22, 2026 and a final approval hearing on July 6, 2026.

Two cautions. First, those dates have passed as of this writing. Second, the page I could read was last updated in March 2026, and the official settlement website, KrispyKremeDataSettlement.com, would not open for me. I cannot tell you whether the court gave final approval or whether payments were made. If you think you may be a class member, check the official site or your notice for the current status. Nothing here is a promise that anyone will receive a payment.

Check your email against known breaches

A breach like this one is one of many. You can also run a free scan on this site to see whether your email address appears in known breaches, using Have I Been Pwned and LeakCheck. It does not look for this specific incident, and an empty result says nothing about data elsewhere. It is a quick way to see which of your accounts deserve a new password.