Glazed and confused: Hole lotta highly sensitive data nicked from Krispy Kreme

Krispy Kreme disclosed a November 29, 2024 cybersecurity incident that impacted 161,676 individuals—primarily current and former employees and family members—exposing extensive sensitive data including names, SSNs, dates of birth, passports, driver’s licenses, biometric data, financial account details and credentials, medical information, and more; the company reported roughly $4.4M in cleanup costs and an estimated $5M EBITDA impact, offered 12 months of credit monitoring and identity protection, and noted that the Play ransomware group claimed responsibility though there is no public evidence of misuse to date.