CHARLOTTE, North Carolina — Krispy Kreme has begun notifying over 160,000 people affected by a data breach last fall.

The doughnut giant is notifying people affected by the breach in November after completing a data review and investigation, Krispy Kreme said in a statement Thursday to The Charlotte Observer.

“We are notifying affected individuals and will be providing detailed information specific to their data,” Krispy Kreme said. “We have no reports that the criminals have used any information for identity theft or fraud as a result of this incident.”

The majority of people affected are Krispy Kreme employees, former employees and members of their families, the company said.

Krispy Kreme is headquartered in Charlotte and has more than 20,000 employees worldwide.

The cyberattack affected 161,676 people, according to a data breach notification on the Maine attorney general’s website, which includes 21 residents there.

Krispy Kreme officials declined to say how many people are affected and where.

About Krispy Kreme’s data breach

Krispy Kreme discovered the incident Nov. 29, the company said.

“We’re experiencing certain operational disruptions due to a cybersecurity incident, including with online ordering in parts of the United States,” Krispy Kreme said on its website at the time.

On May 22, 2025, the company’s investigation determined certain personal information was affected.

The unauthorized access could include name, Social Security number, date of birth, driver’s license or state ID number, credit or debit card and financial information, passwords and emails, as well as medical or health information, and other forms of identification.

Krispy Kreme is offering free credit monitoring and identity protection services for people affected by the data breach, the company said.

Krispy Kreme spent about $3 million on data breach remediation and saw a revenue loss of about $11 million, the company reported in its fourth-quarter earnings in February.

©2025 The Charlotte Observer. Visit at charlotteobserver.com. Distributed by Tribune Content Agency, LLC.