FEDERALItem 1.05 · mandatoryUnknownRetail & ConsumerRetailSupermarketsCustomer Data InvolvedLowActive

Krispy Kreme, Inc.

bd_aecfd6d628a73a4f · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 29, 2024

Filed

Dec 11, 2024

To disclose

12 days

Affected

Not disclosed

Linked

3 filings

Confidence

68%

Full breach record for Krispy Kreme, Inc. →

Krispy Kreme, Inc. reported unauthorized activity on a portion of its IT systems, discovered on November 29, 2024. The company engaged cybersecurity experts and notified federal law enforcement. Operational disruptions include online ordering issues in parts of the US, though physical shops remain open. The investigation is ongoing, and the full scope is unknown. The incident is considered material to business operations and financial condition.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 days

Nov 29, 2024

Discovered

Dec 11, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteplaybd_bc3fdc04058fd5652024-11-29 · +12dVerified by operator
Leak Siteplaybd_728f7ac888b8ab1a2024-11-21 · +20dVerified

Name: Krispy Kreme, Inc.
norm: krispy kreme
SEC CIK: 0001857154
Domain: krispykreme.com

Name: Krispy Kreme, Inc.
norm: krispy kreme
SEC CIK: 0001857154
Domain: krispykreme.com
Industry: Retail & Consumernaics map
NAICS 445110 · Supermarkets and Other Grocery Retailers (except Convenience Retailers)

Discovered: Nov 29, 2024
Materiality determined: Dec 11, 2024
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unknown
Regulator citations: Notified federal law enforcement

During the incident: Immediately began taking steps to investigate, contain, and remediate the incident with the assistance of leading cybersecurity experts
Notified federal law enforcement
Working to restore online ordering
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1857154/000185715424000123/dnut-20241211.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 11, 2024
Raw hash: d5e4347463781ef41c3a6c4a24ce992815ca92739259df222a4bf8028d73b9f0

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html26.3 KB

Download View at source

Linked disclosures

Ransomware claims (2)

Reporting entityKrispy Kreme, Inc.

Victim entityKrispy Kreme, Inc.

Incidentdiscovered Nov 29, 2024

Stated responseImmediately began taking steps to investigate, contain, and remediate the incident with the assistance of leading cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing