Krispy Kreme reports data breach affecting over 7,000 in South Carolina

Krispy Kreme has disclosed that the personal information of more than 7,000 individuals in South Carolina may have been exposed in a cyberattack that occurred in late 2024.

The international doughnut chain said it first detected unauthorized activity within a segment of its IT systems in November 2024. A detailed forensic investigation, concluded in May 2025, confirmed that sensitive personal data may have been compromised during the breach.

According to a notification filed with the South Carolina Department of Consumer Affairs on June 18, the incident affected 7,266 individuals, most of whom are current or former employees and their family members.

The exposed data varies by individual but may include names, Social Security numbers, driver’s license numbers, financial account details, and health insurance information. Despite the nature of the compromised data, Krispy Kreme stated there is no evidence the information has been misused or that any cases of identity theft or fraud have been reported as a result of the breach.

“Krispy Kreme took the appropriate steps to secure our systems following the incident and continues strengthening the security of our systems to further protect the privacy of the data entrusted to us,” the company said in a written statement.

The company has begun notifying affected individuals by mail and is offering complimentary credit monitoring and identity protection services. The notification letters include instructions on how to enroll in these services.

Krispy Kreme is also urging those impacted to remain vigilant by reviewing account statements, monitoring credit reports, and watching for suspicious or unauthorized financial activity.

Individuals with questions about the incident can contact Krispy Kreme’s dedicated assistance line at 866-461-2984, available Monday through Friday from 8 a.m. to 5:30 p.m. Central Time.