Krispy Kreme Data Breach Settlement

Krispy Kreme Data Breach Settlement Opens Compensation Window for Thousands

Business

Data breach settlement offers affected employees up to $3,500 in compensation with June deadline looming.

Over 161,000 individuals eligible for cash payments from $1.6 million settlement fund
November 2024 ransomware attack exposed Social Security numbers and financial information
Documented losses reimbursed up to $3,500; undocumented claims receive approximately $75
Filing deadline is June 22, 2026, with less than one month remaining
Free credit monitoring for one year available to all eligible class members

On Nov. 26, 2024, a ransomware attack and data breach against Krispy Kreme resulted in over 161,000 individuals being affected. Subsequently, affected individuals have been sent notification letters about a $1.6 million class action settlement that provides major payments to eligible individuals. The California Court preliminarily approved the class action settlement on March 5, 2026. The settlement will also provide a financial lifeline to the present and previous employees and their relatives, as they had their sensitive personally identifiable information (PII) stolen in the hacking incident.

The Play ransomware group took responsibility for the attack against Krispy Kreme in late 2024 when it stole approximately 184 gigabytes of data from the company’s elderly network. The attack caused substantial disruptions to Krispy Kreme’s online ordering services throughout the United States during the holiday shopping season, resulting in about $11 million lost in revenue to Krispy Kreme. Krispy Kreme also spent an additional $4.4 million on cybersecurity remediation and independent consulting services to limit the impact of the breach and improve their data security defenses. The hacked information of the victims included more than basic personal identifiers. Personal information exposed to the victims ranged from Social Security numbers, financial account information, driver’s license numbers, passport numbers, and health insurance information which puts all victims at a high risk of identity theft or fraud.

Under this settlement agreement there are two classes of payments that may be claimed by eligible Class Members. Class one includes those who can show proof of financial loss directly resulting from the data breach. These Class Members will be entitled to claim reimbursement of up to $3,500 for expenses incurred as a direct result of the breach. Losses may include unauthorized bank charges, costs for obtaining credit monitoring or time spent fixing theft of their identity.

In addition to being compensated monetarily under the terms of this settlement Class Members will also receive one year of free credit monitoring, regardless of whether they pursue monetary compensation or not. Each will receive a postcard notice containing their activation code to activate their account for the free credit monitoring service on or about March 25, 2026. The deadline for filing claims is critical for affected individuals because claims must be filed or postmarked no later than June 22, 2026; there are less than 30 days left for affected individuals to take action before the claim filing period closes completely. Affected individuals may submit claims on the internet at Krispy Kreme data settlement.com; or, they may mail their supporting documentation to the settlement administrator in Portland, Oregon. Additionally, if individuals want to exclude themselves from the settlement altogether in order to pursue their own legal actions independently from the settlement, that individual must also follow the June 6, 2026 deadline.

Business Honor is of the view that Krispy Kreme's $1.6 million settlement represents a significant acknowledgment of operational security failures and corporate accountability to affected employees.