HackingRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryPIILowContained
Krispy Kreme Doughnut Corporation
bd_fa81ee53b98afb24 · schema v1 · pii pii-v1
Full breach record for Krispy Kreme Doughnut Corporation →Krispy Kreme Doughnut Corporation experienced an external system breach (hacking) affecting its IT systems between November 19 and December 23, 2024. Unauthorized activity was first detected on November 29, 2024, but the impact to personal information was not confirmed until May 22, 2025. A total of 161,676 individuals were affected nationally, including 21 Maine residents. Kroll identity monitoring services (12 months) were offered to affected individuals.
Maine clockDiscovered May 22, 2025 → Filed with AG Jun 18, 202527d ✓ ME AG ≤30d27 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_b0dd709ac92a96cfTexas State AGfiled 2025-06-18Verified by operator
- bd_bbd9bb1e831f985eCalifornia State AGfiled 2025-06-17(1d gap)Candidate
- bd_0d261f83a1177f1aIndiana State AGfiled 2025-06-16(2d gap)Verified
- bd_19e91671f3e66bc8Vermont State AGfiled 2025-06-16(2d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 2d gap
- bd_f982d42904410829Delaware State AGfiled 2025-06-16(2d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0c411aee-5d5d-45bc-b6ad-ec41ce2bfdda.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 18, 2025
- Raw hash
- 7ea685deb647d1b5de1e8094f405f35f3397ee5787b07fb79bc44685d7298789
Reporting entity
- Name
- Krispy Kreme Doughnut Corporationnorm: krispy kreme doughnut
- Domain
- krispykreme.com
- Industry
- Other Commercial
Victim entity
- Name
- Krispy Kreme Doughnut Corporationnorm: krispy kreme doughnut
- Domain
- krispykreme.com
- Industry
- Other Commercial
- Industry
- Retail & Consumerllm
Incident
- Discovered
- May 22, 2025
- Materiality determined
- —
- Notification sent
- Jun 16, 2025
- Affected individuals
- 21
- Data types
- PII
- Attack vector
- Unauthorized Access
- Threat actor
- External
- Regulator citations
- Notified Maine Attorney General
Compliance
- Time to disclose
- 27 days(27 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 27d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 22, 2025→ Filed with AG: Jun 18, 202527d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.