Krispy Kreme Doughnut Corporation Under Investigation for Data Breach of Over 160,000 Employee Records

Schubert Jonckheer & Kolbe LLP is investigating a data breach impacting the sensitive personal and health information of 161,676 current and former employees of Krispy Kreme Doughnut Corporation (Krispy Kreme), based in North Carolina.

According to the company, an unauthorized party gained access to Krispy Kreme’s information technology systems on November 29, 2024. The Play ransomware gang claimed responsibility for the data breach in December 2024.

Krispy Kreme recently informed patients that the following personal and health information may have been stolen in the breach: names; Social Security numbers; health insurance information; dates of birth; driver’s license or state ID number, financial account information, financial account access information, credit or debit card information, credit or debit card information in combination with a security code, username and password to a financial account, passport number, digital signature, username and password, email address and password, biometric data, USCIS or Alien Registration Number, US military ID number, medical or health information, and health insurance information. 

Although the breach occurred over six months ago, Krispy Kreme only began notifying impacted patients on or around May 22, 2025, which may have violated state and federal laws. 

If your personal information was impacted by this incident, you may be at risk of identity theft and other serious violations of your privacy. As a result, you may be entitled to money damages and an injunction requiring changes to Krispy Kreme’s cybersecurity practices.

If you received notification of this data breach or are a current or former employee of Krispy Kreme and wish to obtain additional information about your legal rights, please fill out the form below.