Desk live·
ForensicPost
Ransomware/Retail/File 24-1129

Krispy Kreme Breach Hit 161,676 People, Most of Them Its Own Staff

A November 2024 attack on the doughnut chain exposed personal data belonging to 161,676 people. The company said the vast majority were employees, their family members and former employees.

Constructed geometry · not a chart of case data
JurisdictionUSAthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetKrispy Kreme
ActorUnattributed
S. Rosler8 min readConfidence: high1 source reviewed

Krispy Kreme reported that a cyberattack in November 2024 led to the theft of personal information belonging to 161,676 people. The company said the vast majority of those affected were employees, members of their families and former employees.

The Workforce, Not The Customers

Coverage of a retail breach assumes shoppers. Here the affected population is the people who work there, the people related to them, and the people who used to work there.

Employee records are the least considered category in this database. Staff cannot take their data elsewhere, did not agree to the arrangement in any meaningful sense, and appear in the reporting as a footnote to whatever commercial disruption occurred.

Family Members Had No Relationship At All

Relatives appear in these records through benefits enrolment — a spouse on a health plan, a child as a dependant. They never dealt with the company.

That is one step further removed than the supplier cases that dominate this file set. The affected person is not the customer of a customer; they are the family of an employee of the breached organisation.

How we reported this

Compiled from the company’s regulatory notifications and public reporting, listed below. No operation is named and no entry route was published. Corrections: corrections@forensicpost.com.

Sources
  1. Krispy Kreme: Over 160,000 people had data stolen during November 2024 cyberattackThe Record
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary