Krispy Kreme 8-K earnings exhibit discloses cybersecurity insurance recovery
Krispy Kreme says in an 8-K exhibit it recognized a $9.3 million cyber insurance recovery in 2025; no incident details given, watch official updates.
- Published
- Ecosystem
- Enterprise software
- Exploitation
- No, not confirmed: the filing exhibit gives no details of any intrusion, cause or data involved
What happened
Krispy Kreme, Inc. (NASDAQ: DNUT) filed its third quarter 2026 results press release as Exhibit 99.1 to an SEC filing dated November 5, 2026, according to SEC EDGAR. The SEC EDGAR headline for this story describes it as Krispy Kreme disclosing a cyber incident in a Form 8-K filing (SEC EDGAR).
In the exhibit, Krispy Kreme says its prior year results included a “$9.3 million cybersecurity insurance recovery recognized in the prior year period,” which it places in the third quarter of 2025 (SEC EDGAR). The company says comparisons of Adjusted EBITDA, overall and in the U.S. segment, are affected by “lapping” that recovery.
The exhibit does not describe a new incident. According to the text provided, it does not state when an incident occurred, how it happened, which systems were involved, whether customer or employee data was affected, or who was responsible. All of these details are not confirmed.
Am I affected?
Not confirmed. The exhibit names no affected systems, data types, customers, products or software (SEC EDGAR). It contains no CVE, version or technical indicator. Nothing in the source suggests that developers or third-party software are exposed.
What to do now
- Read the filing exhibit directly on SEC EDGAR rather than relying on summaries.
- Watch for any further Krispy Kreme filings or customer notices that give incident specifics. None are in the source.
- Treat claims about attackers, stolen data or impact as unverified unless Krispy Kreme or an official body confirms them.