Krispy Kreme Agrees to $1.6 Million Class-Action Settlement After 2024 Cyberattack
Krispy Kreme Reaches $1.6M Settlement for 2024 Data Breach
Related Entities
Other
Full Report
Executive Summary
The doughnut chain Krispy Kreme has agreed to a $1.6 million settlement to resolve a class-action lawsuit stemming from a 2024 data breach. The cyberattack exposed sensitive customer information, including names, dates of birth, Social Security numbers, and financial account access details. The settlement provides a tiered compensation structure for affected customers and includes provisions for credit monitoring services. While Krispy Kreme denies any liability or wrongdoing, the company has agreed to enhance its cybersecurity measures as part of the settlement terms.
Regulatory Details
This incident has moved from a cybersecurity event to a legal and regulatory one. The class-action settlement is a legal mechanism to compensate a group of affected individuals and resolve the lawsuit against the company.
Settlement Terms:
- Total Fund: $1.6 million.
- Compensation for Documented Loss: Customers who can provide proof (receipts, bank statements) of financial loss or fraud resulting from the breach are eligible for reimbursement up to $3,500.
- Compensation for Data Exposure: Customers whose data was exposed but who cannot document a specific financial loss are eligible for a $75 payout.
- Credit Monitoring: All eligible individuals can receive one year of free credit monitoring and identity theft protection services.
- Claim Deadline: June 22, 2026.
As part of the settlement, Krispy Kreme has also committed to strengthening its cybersecurity protocols, a common component of such agreements, which is overseen by the court.
Affected Parties
- Organization: Krispy Kreme
- Individuals: Customers whose personal and financial information was stored by Krispy Kreme and compromised in the 2024 breach.
Exposed Data Included:
- Names
- Dates of birth
- Social Security numbers
- Financial account access information
Impact Assessment
- For Customers: Affected individuals face an increased risk of identity theft and financial fraud. The settlement provides a path for financial recourse, but the inconvenience and potential for long-term identity issues remain.
- For Krispy Kreme: The direct financial impact includes the $1.6 million settlement fund, legal fees, and the cost of implementing enhanced security measures. The breach and subsequent lawsuit also carry reputational damage, although this is often less severe for consumer brands in the food and beverage sector compared to technology or finance companies.
Compliance Guidance
This case serves as a reminder for all retail and consumer-facing businesses of the legal and financial consequences of a data breach.
- Data Governance: Organizations must have a clear understanding of what customer data they collect, why they collect it, and where it is stored. Data that is not essential should not be retained.
- Incident Response Planning: A comprehensive incident response plan should include not only technical containment but also legal and public relations strategies for managing the aftermath of a breach.
- Cyber Insurance: Having a robust cyber insurance policy is critical to cover the costs of breach notification, credit monitoring, legal defense, and settlements.
Lessons Learned
- Any Company is a Target: Even companies not typically seen as 'tech' companies, like a doughnut chain, collect valuable data and are targets for cybercriminals.
- The Long Tail of a Breach: The financial and legal consequences of a data breach can last for years after the initial incident, as demonstrated by this 2026 settlement for a 2024 attack.
- Settlements are a Business Decision: Krispy Kreme's denial of wrongdoing while agreeing to the settlement is standard legal practice. It is often cheaper and less risky for a company to settle than to engage in a prolonged court battle, regardless of guilt.
Timeline of Events
MITRE ATT&CK Mitigations
Storing sensitive data like Social Security numbers and financial information in an encrypted format is a fundamental control to protect against data breaches.
Applying the principle of least privilege to file systems and databases ensures that a compromised account or service can only access a limited set of data.
Mapped D3FEND Techniques:
Enforcing strong password policies and securely storing password hashes (e.g., using bcrypt) is crucial for protecting customer accounts.
D3FEND Defensive Countermeasures
The exposure of Social Security numbers and financial data indicates a critical failure in data-at-rest protection. As a core part of its enhanced cybersecurity protocols, Krispy Kreme must implement robust file and database encryption. All sensitive PII, especially high-risk data like SSNs, should be encrypted in the database at the application layer. This means the data is encrypted before being written to the database, and the application manages the decryption process upon authorized request. This ensures that even if an attacker gains access to the database server or a database backup, the sensitive data remains unreadable without the application's decryption keys, which should be stored separately and securely in a hardware security module (HSM) or a dedicated key management service.
To prevent widespread data access in a breach, Krispy Kreme should implement the principle of least privilege through strict User Account Permissions. This involves creating granular access roles for different applications and services. For example, a front-end web server's service account should not have permission to read the entire customer database. Instead, it should only be able to query for specific customer records through a well-defined API. Similarly, internal marketing tools should only have access to non-sensitive data like names and email addresses, and be explicitly denied access to SSNs or financial information. By segmenting data access based on the functional requirements of each service, the company can significantly limit the amount of data an attacker can exfiltrate if they compromise a single component of the system.
Timeline of Events
A cyberattack occurs at Krispy Kreme, exposing customer data (exact date in 2024 not specified).
Deadline for affected Krispy Kreme customers to submit a claim under the class-action settlement.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.