Krispy Kreme, a beloved doughnut chain in the U.S., recently became the target of a cybersecurity attack that has disrupted its online ordering system. First detected on November 29, 2024, the incident has significantly impacted the company’s ability to process digital orders across parts of the United States.

Despite this, Krispy Kreme has assured customers that its retail stores remain open, and deliveries to partner retailers and restaurants continue without interruptions.

Investigation and Recovery Efforts Underway

According to an 8-K filing submitted to the SEC, Krispy Kreme was notified of unauthorized activity within its IT systems. The company immediately engaged renowned cybersecurity experts to investigate and remediate the issue.

While the specifics of the cyberattack remain undisclosed, the company has taken preventive measures, including suspending online services in some regions.

Impact on Operations and Financials

The attack’s timing was particularly challenging, as it coincided with the annual “Day of the Dozens” promotion on December 12. This event offers customers a free dozen Original Glazed doughnuts with the purchase of another dozen at regular price—a highlight for Krispy Kreme fans. Due to the cyber disruption, this promotion was limited to in-store purchases and drive-thru services, excluding online orders.

Krispy Kreme anticipates significant financial repercussions, including lost digital revenue, cybersecurity expert fees, and system restoration costs. However, the company’s robust cybersecurity insurance is expected to offset some of these expenses.

Customer Assurance and Long-Term Outlook

Krispy Kreme remains optimistic about its future, emphasizing that the incident is unlikely to have a long-term impact on its financial health or operations. Digital orders accounted for 15.5% of the company’s total sales in Q3 2024, showcasing the importance of online channels to its business model.

Continued Commitment to Quality and Service

While recovery efforts are ongoing, Krispy Kreme has demonstrated resilience in maintaining its in-store services and supply chain. Notably, the company’s operational technology and retail logistics appear unaffected, ensuring customers can still enjoy their favorite treats.

As the investigation proceeds, Krispy Kreme is also strengthening its cybersecurity defenses to prevent future incidents.

Key Takeaways

• What Happened: A cybersecurity incident disrupted Krispy Kreme’s digital ordering system on November 29, 2024.
• Operational Impact: Online orders were halted, but retail shops and deliveries remained unaffected.
• Financial Repercussions: Costs include lost digital revenue and cybersecurity recovery efforts, partially covered by insurance.
• Promotion Adjustments: “Day of the Dozens” was limited to in-store purchases due to the attack.
• Long-Term Confidence: The company does not foresee lasting operational or financial damage.

Stay Updated

As Krispy Kreme continues to address the incident, customers are encouraged to visit stores or use drive-thru services for their doughnut cravings. Stay tuned for updates as the company works diligently to restore its online systems and enhance security measures.

Maya Carter