Krispy Kreme Doughnut Corporation
bd_b0dd709ac92a96cf · schema v1 · pii pii-v1
Full breach record for Krispy Kreme Doughnut Corporation →Krispy Kreme Doughnut Corporation based in Charlotte, North Carolina, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-05-22 and reported on 2025-06-18. 6,948 Texas residents were affected. 161,676 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via Posted at company website or special website;U.S. Mail.
J jump to incidentP pin to compareR raw source
Incident timeline
Nov 19, 2024
Begins
May 22, 2025
Discovered
Jun 18, 2025
Filed
vs. sector median
4 wks faster
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- New Hampshire State AGbd_53b697732f6e933e2025-06-18Verified
- South Carolina State AGbd_a377bfb677b7e83f2025-06-18Verified
- Maine State AGbd_fa81ee53b98afb242025-06-18Verified by operator
- Massachusetts State AGbd_65362ff1582efe022025-06-17 · +1dVerified
Show 6 more filings ↓Show fewer ↑up to 17d gap
- Rhode Island State AGbd_a58e9e0b70ac44ec2025-06-17 · +1dVerified
- California State AGbd_bbd9bb1e831f985e2025-06-17 · +1dCandidate
- Indiana State AGbd_0d261f83a1177f1a2025-06-16 · +2dVerified
- Vermont State AGbd_19e91671f3e66bc82025-06-16 · +2dVerified
- Delaware State AGbd_f982d429044108292025-06-16 · +2dVerified
- Illinois State AGbd_942423996e40aa312025-06-01 · +17dVerified
Filing propagation · 11 filings · 11 states
View merged incident ↗Pattern: first filing Jun 1 (IL), last Jun 18 (TX) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.