Krisky Kreme to pay $1.6 million to settle data breach class action lawsuit

U.S. doughnut chain Krispy Kreme has agreed to pay $1,616,760 to settle a class action lawsuit arising from a data breach incident in November 2024 that compromised the personal information of 161,676 former and current employees.

 

The American multinational doughnut company and coffeehouse chain, which runs more than 1,500 stores, suffered a serious data breach on November 29, 2024, that involved malicious actors infiltrating portions of its internal network and exfiltrating the personal information of tens of thousands of employees.

 

Krispy Kreme said in a data breach notice posted on its website that the compromised information included current and former employees’ names, Social Security numbers, dates of birth, driver’s license or state ID numbers, financial account information, usernames and passwords to financial accounts, passport numbers, digital signatures, and more.

 

The fast food company informed the Office of the Attorney General of Maine in June 2025 that the data security incident, which occurred between November 19, 2024 and December 23, 2024, compromised the personal information of at least 161,676 individuals.

 

Subsequently, more than a dozen class action lawsuits were filed against the fast food chain in the U.S. District Court for the Western District of North Carolina, alleging that Krispy Kreme failed to properly secure the sensitive personal information of its employees which resulted in the significant data breach in late 2024. All the class action lawsuits were merged into a consolidated class action complaint on October 17, 2025.

 

Earlier this week, the District Court released a settlement agreement between Krispy Kreme and affected class action members wherein the Doughnut chain agreed to pay $1,616,760 to settle the class action without admitting any liability or wrongdoing. 

 

The doughnut chain told the Court that it intended to settle the class action in the interest of class members, to avoid litigation costs and additional expenses and disruption to business operations associated with further litigation. 

 

As per the settlement agreement, affected individuals are entitled to a basic settlement payout of $75 and additional payout of up to $3,500 if they are able to furnish documented proof of losses suffered as a result of the data breach incident. The class members have until June 22, 2026, to submit a claim to avail the payouts, to exclude themselves from the settlement or to object to the terms of the settlement. 

 

The final settlement figure is due to be approved by the District Court for the Western District of North Carolina during a Final Settlement Approval Hearing scheduled on July 6, 2026.