Skip to content
DysruptionHub
Sign in Subscribe

Krispy Kreme cyberattack disrupts U.S. online ordering

Summary

Krispy Kreme logo

Unauthorized activity disrupted Krispy Kreme’s online ordering in parts of the United States in late 2024. Later filings described personal-information impact, business losses and a data-security settlement.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Retail operations disrupted

    Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Incident narrative

What happened

Unauthorized activity in Krispy Kreme’s technology systems disrupted online ordering in parts of the United States in late 2024. The company disclosed the incident Dec. 11, saying it had been notified Nov. 29 and had engaged outside cybersecurity specialists.

Shops remained open for in-person orders, and daily deliveries to retail and restaurant partners continued.

Service recovery

Krispy Kreme announced the return of online ordering Dec. 30. Its subsequent financial reports said core business functions were fully operational, but documented operational inefficiencies early in 2025.

The company estimated $11 million in lost U.S. revenue for the fourth quarter of 2024. It later estimated a combined $15 million impact on adjusted earnings before interest, taxes, depreciation and amortization across that quarter and early 2025. That earnings estimate includes lost sales margin and operational inefficiencies.

Personal information and attribution

Krispy Kreme Doughnut Corporation’s breach notice says investigators determined May 22, 2025, that personal information had been affected. The Indiana attorney general’s breach register lists 161,676 affected people, including 4,810 Indiana residents. It records Nov. 19, 2024, as the breach occurrence date and June 16, 2025, as the notification date. Those milestones do not establish when online ordering first failed.

The filed settlement agreement describes unauthorized acquisition of current and former employees’ private information. That account is separate from Play’s claimed file inventory; the company denied liability in settling the case.

The company offered identity monitoring and said it had no reports of related identity theft or fraud at the time of the notice.

Play claimed the intrusion and threatened to release purportedly stolen files, SecurityWeek reported Dec. 20, 2024. The company’s reviewed disclosures do not independently confirm the group’s identity or file encryption.

Subsequent developments

The company reported receiving insurance recoveries and substantially completing its investigation during the second quarter of 2025. A settlement administrator later reported final approval of a $1,616,760 data-security settlement on July 30, 2026, and the dispatch of awards Sept. 14. The company denied wrongdoing in the litigation.

Threat actor and claim

Play

Listed as: Krispy KremeSource: ransomware.liveDiscovered:

Claim details

Play claimed Krispy Kreme and threatened to release purportedly stolen files. SecurityWeek reported the claim Dec. 20, 2024, and the ransomware.live record preserves the allegation. The tracker timestamp records observation of the listing; the original post’s precise publication time is unverified. Company filings independently confirm unauthorized activity and operational disruption but do not confirm Play’s identity, its full claimed file inventory or encryption. The filed settlement agreement separately describes acquisition of employee information.

Organizations involved

Impacted location

  • Charlotte, North Carolina

    Charlotte contains the affected company’s principal executive office at 2116 Hawkins Street, Suite 101. The online-ordering disruption affected parts of the United States; this headquarters anchor does not establish a citywide outage or the location of compromised servers.

Sources

Notice of Data Breach
Krispy Kreme Doughnut CorporationPublished: Retrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web
Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.