Krispy Kreme, Inc.
Dec 2024 · Graded Verified · Retail and Consumer · Government record
Incident summary
Krispy Kreme, Inc.Dec 2024
$11M est.
Orders & sales lost
Business interruption
Of that, about $10M was lost profit.
The outage that halted online doughnut orders was the visible damage; the real loss was the identity file of roughly 161,000 people, almost all of them staff and their families, holding Social Security numbers, passports, biometrics, and military IDs. Play claimed the intrusion and leaked 184 gigabytes after the ransom went unpaid, though how the systems were first entered was never stated. A doughnut seller kept an HR intelligence dossier on the people who fry them, and that is the file the breach walked out with.
Losses on the record
$7.4M
Spent responding & recovering
Direct expense
$5M est.
Orders & sales lost
Business interruption
These measure different things and are never added together.
See the full accounting
Business interruption · estimated$11M · V
Business interruption · estimated$10M · V
Business interruption · estimated$5M · V
Direct expense · realized$7.4M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Play
Quantified 148 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.