Krispy Kreme Discovers Cybersecurity Hole

Fried dough lovers beware: doughnut juggernaut Krispy Kreme told U.S. federal regulators Wednesday it will have ongoing operational difficulties due to a cybersecurity incident.

See Also: Gartner Guide for Digital Forensics and Incident Response

A self-described “sweet treat” chain based in North Carolina once confined to Southern states, Krispy Kreme went national, and then global, during the 1990s. It reported $1.5 billion in revenue during 2023.

In a filing, Krispy Kreme said its shops are open and consumers can place orders in person. Online ordering in some parts of the United States is down. Deliveries to retail outlets and restaurants, including McDonald’s, are uninterrupted.

“As of the date of this filing, the incident has had and is reasonably likely to have a material impact on the company’s business operations until recovery efforts are completed,” it said. The company became aware of “unauthorized activity” on its network on Nov. 29.

Online ordering accounted for 15% of doughnut sales during the summer months, the company disclosed in November.

Trading during the first hours of Wednesday drove the company’s stock price down by 2.8 %. Krispy Kreme trades as “DNUT.” The company earlier this year divested its majority share of Insomnia Cookies, an e-commerce venture that promises the delivery of warm cookies until 3 AM, in order “to focus on our core strategy of producing, selling and distributing fresh doughnuts daily.”

The Securities and Exchange Commission in June 2023 imposed disclosure requirements onto publicly traded companies for cybersecurity incidents whenever there is “a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision (see: SEC Votes to Require Material Incident Disclosure in 4 Days).

Krispy Kreme told regulators it doesn’t expect the event to have a long-term material impact and that it will offset the cost of incident response with a claim against its cybersecurity insurance policy.

Although the incident has the hallmarks of a financially-motivated cybersecurity attack likely involving ransomware, so far the company hasn’t disclosed the nature of the attack. A company spokesperson said Krispy Kreme has nothing further to disclose beyond what it already told regulators.