Krispy Kreme has agreed to pay out more than $1.6 million following claims tied to a data breach reported in November 2024.
The incident is alleged to have exposed sensitive details belonging to people employed by the donut chain at the time. Reported information involved includes names, dates of birth, Social Security numbers and financial account data, according to NBC Chicago. The breach was said to have been discovered on November 29, 2024.
The Office of the Attorney General of Maine says roughly 161,000 current and former employees were affected. Its website states 21 people in Maine were impacted.
Although Krispy Kreme — which reportedly operates around 2,000 retail locations globally — has denied wrongdoing, the company has agreed to a $1,616,760 settlement to resolve the allegations.
Under the proposed payout, some eligible individuals could receive up to $3,500.
According to the settlement website, people included in the ‘Settlement Class’ are US residents who were ‘sent a notice of the data Incident indicating that your private information may have been impacted in the data incident’.
To qualify for the maximum $3,500, class members must also provide documentation showing they ‘cover documented losses related to fraud or identity theft resulting from the breach’, AL.com reports.
Examples of supporting materials may include bank statements and invoices connected to the cyberattack. Those who do not provide that documentation can instead receive a $75 cash payment.
LiveNOW from Fox reports that impacted individuals will receive one year of free credit monitoring regardless of whether they submit a claim.
People who believe they are eligible and want to receive payment must submit a claim form by June 22, 2026. Claims can be filed through the Krispy Kreme Data Security Settlement site, or by requesting forms via phone at 1-877-239-1879.
If you want to remain part of the settlement but object to the terms, you must do so by June 6, 2026. A final settlement approval hearing is scheduled for July 6, when the court will decide whether to approve the agreement.
June 6 is also the deadline to opt out entirely. Requests for exclusion must be mailed to the settlement administrator.
The settlement website notes that by excluding yourself, you ‘keep your right to file your own lawsuit against the released parties about the released claims that are released by the settlement in this lawsuit’.