$1.6M Krispy Kreme Data Breach Settlement, Are You Eligible to Claim Before June 22?

Krispy Kreme Doughnut Corporation agreed to pay $1,616,760 to resolve a class action lawsuit over a November 2024 cyberattack that exposed the personal information of 161,676 current and former employees. The settlement received preliminary court approval on March 5, 2026. Eligible class members can claim up to $3,500 for documented losses — or approximately $75 with no proof required — before the June 22, 2026 deadline.

Quick Facts

Field	Detail
Settlement Amount	$1,616,760
Claim Deadline	June 22, 2026
Who Qualifies	U.S. residents who received a Krispy Kreme data breach notification
Payout Per Person	Up to $3,500 (documented losses) or ~$75 (no proof required)
Proof Required	Yes for $3,500 option / No for $75 option
Settlement Status	Preliminarily approved — claims open
Administrator	Krispy Kreme Data Incident Settlement Administrator
Official Website	KrispyKremeDataSettlement.com

Where the Case Stands Right Now

• The court entered the preliminary approval order on March 5, 2026. A claim form must be filed before June 22, 2026, and any exclusion or objection must be filed before June 6, 2026.
• The court will decide whether to approve the settlement at the final approval hearing on July 6, 2026, at 9:30 AM EDT.
• Compensation will begin going out to class members only after final approval is granted and any appeals are resolved.

What Is the Krispy Kreme Data Breach Lawsuit About?

Krispy Kreme Doughnut Corporation reported a data breach affecting 161,676 individuals — the majority of whom are current and former employees and their family members. The incident involved unauthorized access to portions of the company’s information technology systems and was detected on November 29, 2024.

The Play ransomware gang later claimed responsibility for the attack and threatened to release the stolen data. Krispy Kreme filed with the U.S. Securities and Exchange Commission at the time, disclosing that certain business operations had been disrupted and that its online ordering systems were expected to remain offline during recovery.

The plaintiffs argued that Krispy Kreme failed to comply with its data security obligations under the Federal Trade Commission Act, the Health Insurance Portability and Accountability Act, and general industry guidelines. The lawsuit alleged the company failed to adequately protect employees’ private information and failed to encrypt or redact highly sensitive data before the breach occurred.

What Data Was Exposed?

The class action lawsuit claimed that Krispy Kreme failed to protect current and former employees’ sensitive personal information — including Social Security numbers, names, driver’s license or state ID numbers, dates of birth, financial account information, credit or debit card information, biometric data, health and health insurance information, USCIS or Alien Registration Numbers, military ID numbers, email addresses, passwords, passport numbers, and digital signatures.

Not every affected individual had all of these data types exposed. The specific information involved in your case appears in the breach notification letter Krispy Kreme sent to affected workers.

Who Is Eligible to File a Claim?

You may qualify for a payment from this settlement if:

• You are a living individual residing in the United States
• You received a notice from Krispy Kreme indicating your personal information may have been impacted by the data breach discovered on November 29, 2024
• You are a current or former Krispy Kreme employee, or an eligible family member of one
• You have not already been fully reimbursed for your documented losses through another source

The eligibility question is straightforward. If Krispy Kreme sent you a notification indicating your personal information may have been affected by the November 2024 breach, you qualify. The notification could have arrived as a postcard, letter, or email.

Related article: If My Daughter Died, Will My Son-in-Law Inherit My Estate? Here’s the Real Answer

How Much Can You Receive?

The settlement offers three separate benefits. You can only choose one cash payout option, but the credit monitoring is available to everyone automatically.

Option A — Documented Losses (up to $3,500): Class members can claim up to $3,500 in documented losses related to fraud or identity theft resulting from the data breach. Acceptable documentation includes receipts, invoices, and bank or credit card statements showing unreimbursed fees and fraudulent charges.

Option B — Flat Cash Payment (approximately $75): Class members who do not submit documented losses can submit a claim to receive a cash payment estimated at $75. The settlement administrator will determine the final payment amount based on the total number of claims filed. This means the actual amount could be higher or lower depending on total claim volume.

Free Credit Monitoring (no claim form required): All Krispy Kreme settlement class members are automatically eligible to receive one year of one-bureau credit monitoring services, which includes $1,000,000 in identity theft insurance with no deductible. Enrollment codes for this service appear on each class member’s copy of the settlement notice.

How to File a Claim

Step 1 — Visit the official claim website at KrispyKremeDataSettlement.com

Step 2 — Locate the unique ID and 4-digit PIN printed on the postcard notice Krispy Kreme mailed you

Step 3 — Enter your unique ID and PIN to access your claim form online

Step 4 — Select your payout option — documented losses (up to $3,500) or the flat cash payment (~$75)

Step 5 — Upload supporting documentation if you choose the documented losses option (bank statements, receipts, fraud records)

Step 6 — Submit your claim and save your confirmation number for your records

If you did not receive a postcard notice or have lost yours, contact the settlement administrator at [email protected] or 1-877-239-1879 for assistance. You can also mail a paper claim form to: Krispy Kreme Data Incident Settlement Administrator, PO Box 2047, Portland, OR 97208-2047.

Estimated time to complete: 5–10 minutes.

Important Deadlines and Dates

Milestone	Date
Data Breach Discovered	November 29, 2024
Settlement Proposed	January 28, 2026
Preliminary Approval Granted	March 5, 2026
Opt-Out Deadline	June 6, 2026
Objection Deadline	June 6, 2026
Claim Filing Deadline	June 22, 2026
Final Approval Hearing	July 6, 2026 at 9:30 AM EDT
Expected Payment Date	Approximately 75 days after final approval

Frequently Asked Questions

Do I need a lawyer to file a claim? 

No. You do not need an attorney to file a claim in this settlement. The process takes roughly 5–10 minutes online using the unique ID and PIN from your settlement notice. You only need a lawyer if you want to opt out and pursue an individual lawsuit instead.

Is this settlement legitimate?

 Yes. The case is In Re: Krispy Kreme Data Security Litigation, Case No. 3:25-cv-00434-MOC-SCR, pending in the U.S. District Court for the Western District of North Carolina before Judge Max O. Cogburn, Jr. The official settlement website is KrispyKremeDataSettlement.com. Krispy Kreme denies any wrongdoing but agreed to settle to avoid the cost of continued litigation.

When will I receive my payment?

 The settlement administrator will issue payments to approved claimants approximately 75 days after the court grants final approval of the settlement. The final approval hearing is scheduled for July 6, 2026, so payments could begin in the fall of 2026, assuming no appeals delay the process.

What if I missed the claim deadline? 

The claim deadline is June 22, 2026. If you miss that date, you will not receive a cash payment or credit monitoring benefit from this settlement. You will still be bound by the settlement’s release of claims against Krispy Kreme — meaning you generally cannot sue the company separately over this breach — unless you opt out before June 6, 2026.

Will this settlement payment affect my taxes? 

Payments that compensate you for documented out-of-pocket losses from a data breach are generally not considered taxable income because they reimburse money you already lost. The flat $75 cash payment may be treated differently. Consult a tax professional for guidance specific to your situation.

I was a former employee. Do I still qualify?

 Yes. The settlement covers all United States residents whose private information was impacted by the data breach, including both current and former Krispy Kreme employees. If you received a breach notification from Krispy Kreme, you qualify regardless of whether you still work there.

What is the difference between the $75 payment and the $3,500 payment? 

The $75 option requires no documentation — you simply submit your claim form and wait. The $3,500 option covers actual out-of-pocket losses you can prove, such as fraudulent charges on your accounts or fees you paid for identity protection services. The two options are mutually exclusive, so choose the one that best fits your situation.

What happens if I do nothing?

 If you do nothing, you will automatically receive the free one-year credit monitoring benefit — but you will not receive any cash payment. You also give up your right to sue Krispy Kreme separately over this breach. If you want to preserve the right to file your own lawsuit, you must opt out in writing before June 6, 2026.

Sources and References

• In Re: Krispy Kreme Data Security Litigation, Case No. 3:25-cv-00434-MOC-SCR — official settlement website

Last Updated: April 4, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.