A newly approved class action settlement could put extra cash in yourpocket if you qualify for a payment. Krispy Kreme agreed to a $1.6 millionsettlement regarding an alleged data breach, and victims could potentiallyreceive as much as $3,500 in payment. Victims should work quickly tosubmit a claim by the June 22 deadline.
Here’s what you need to know about the settlement, whether you might qualify,and how to submit a claim.
Find out: 14 moves seniors could benefit from but often forget about.
The Krispy Kreme class-action lawsuit
In November 2024, a cyberattack compromised personal information includingnames, numbers, dates of birth, social security information, driver’s licensenumbers, health information, and financial accounts of over 160,000 current andformer Krispy Kreme employees. In some cases, the information of employees’family members was also exposed.
Krispy Kreme disclosed the breach in December 2024, and a class action lawsuitfollowed, alleging the company failed to prevent unauthorized access to thesensitive information it had collected and stored. Play, a ransomware group,allegedly claimed that they were responsible for the cyberattack and indicatedthat they had stolen hundreds of gigabytes of data.
Shopping for cheaper auto insurance? Enter your zip code here to get started.
The Krispy Kreme settlement
While Krispy Kreme denied wrongdoing, the company ultimately agreed to asettlement, and the lawsuit didn’t go to court. The company reached a preliminarysettlement in March, and the court is scheduled to decide whether to issue afinal approval on July 6, 2026.
Who qualifies for a payout
Individuals who qualify for a payout must live in the United States. They musthave also received a Notice of the Data Incident; that notice informedthem that their data had been compromised during the November cyberattack.
The notice read, in part: “Upon learning of the unauthorized activity, weimmediately began taking steps to investigate, contain, and remediate theincident with the assistance of leading cybersecurity experts. In addition tocontaining the incident, we contacted law enforcement and engaged leadingcybersecurity firms to assist us in assessing the incident’s scope and cause.”
Retire like the rich: 14 ways you could build wealth in your 50s.
What affected employees received
In addition to informing employees that their information had been involved inthe data breach, the notice included details about available identity monitoringservices being offered. Those services included options like credit monitoring,fraud consultation, and identity theft restoration for qualifying employees.
What qualifying individuals need to do to file a claim
Affected individuals won’t automatically receive a payout from the settlementand need to submit a claim form; the form must be submitted or postmarked byJune 22. The claim form is available on the settlement website,KrispyKremeDataSettlement.com.
Affected individuals do not need to submit a claim form to receive 12 months ofcredit monitoring as described in the Notice of the Data Incident.
Claiming the $3,500 payout
The settlement features a two-tier payout structure. Victims with documentedlosses related to fraud or identity theft resulting from the data breach maysubmit a claim for a cash payment of up to $3,500. Documentation might includephone records, emails, or receipts proving the loss. Documents like personalcertifications or declarations aren’t considered to be reasonable documentation.
If you don’t submit documentation or if the documentation you provide doesn’tsupport the loss or is declared invalid, your claim may be processed as analternative cash payment.
Dave Ramsey Urges Americans to Become Debt-Free: Try these 7 clever ways to crush your debt
Claiming the alternative cash payment
Victims who don’t have a documented loss related to the data breach may applyfor an alternate cash payment. No documentation is required, and the cashpayment is estimated to be about $75. Victims still need to submit a claim formto receive the alternative cash payment.
Expected settlement amounts
The exact amount of the cash payments may vary depending on the number of validclaims. If the number of valid claims doesn’t use the entire settlement fund,payment amounts may be increased. However, if the number of valid claims exceedsthe amount of the settlement fund, payment amounts may be reduced.
Payments should be issued after the settlement is approved by the court.
How to opt out of the settlement
If victims don’t opt out of the settlement, then all court orders and judgments apply to the victims, and victims are not going to be able to sue or be part of anyother lawsuit against Krispy Kreme relating to the data breach.
To opt out of the settlement, you must mail a written request for exclusion tothe settlement administrator. Your request must be postmarked by June 6, 2026,and must include your name, address, telephone number, email address, physicalsignature, and a statement that you want to be excluded from the settlement.There is no option to opt out by email or phone.
Grow Your $$: 9 things you must try when your savings reach $50,000
Bottom line
If you received a Notice of the Data Incident, you may be eligible to receive apayout. If you’re unsure about whether you qualify for the settlement, you maycontact the settlement administrator through the website or by phone at1-877-239-1879. Be sure to act quickly, since deadlines are quickly approaching.If you want to opt out or object, you must do so by June 6, 2026. Claims must besubmitted or postmarked by June 22, 2026.
Even if you don’t file a claim, you may still qualify for a year of free creditmonitoring, which may offer extra security. Knowing you’re staying on top ofyour credit may give you some reassurance and help lower your financial stress.
More from FinanceBuzz: