Krispy Kreme hack results in data leak for employees and their families

American coffee chain Krispy Kreme has confirmed a massive data breach following a Play ransomware attack in December 2024. Cybercriminals stole 184GB of sensitive information, which was later published on the darknet.

The incident occurred on December 11, 2024, when the company experienced major disruptions. A week later, the Play group claimed responsibility for the attack, claiming to have stolen a large amount of documents: personal data, financial statements, payroll information, contracts, and medical records.

• In 2025, Krispy Kreme began sending warning letters to victims. The investigation revealed that full names, dates of birth, social security numbers, passports, driver’s licenses, logins and passwords, payment information, biometrics, US military IDs and even medical information were stolen.

Most of the victims were current or former employees of the company and their family members. At least 7,000 cases of leakage were recorded in Texas. Considering the company’s staff of 20,000 employees, thousands of people are likely affected.

Krispy Kreme is a well-known American chain of coffee shops and donut shops. The Play ransomware attack occurred at a time when cybercriminal groups have intensified attacks on retail chains. The group published 184 GB of data on the darknet, presumably due to the company’s refusal to pay the ransom. The company reported more than $11 million in remediation costs in 2024, and expects them to increase in 2025.

Despite claiming that the stolen data was not used, Krispy Kreme offered victims free credit monitoring and personal data protection. The incident highlights the growing threat of ransomware attacks to the consumer sector. Even the largest brands with thousands of employees are not protected from the leakage of critical data. Free protection services are only the minimum in response to the real consequences, which include financial losses, lawsuits and loss of customer trust.