Do we like them?

Do we like Krispy Kreme?

Doughnut and coffee chain selling through shops, kiosks and stores worldwide. Based in Charlotte, North Carolina.

Our score: 4 out of 10. Not one we'd back with our money yet. The employee data breach and the investor lawsuit are weak spots. We found little sourced good deed to balance them.

Krispy Kreme is the hot-light doughnut chain from North Carolina, now run by CEO Josh Charlesworth, who has held the job since January 2024. It floated on Nasdaq in 2021. JAB, the investment firm tied to Germany's Reimann family, still holds about 43% and has the biggest say.

In late 2024 a ransomware attack hit the company and disrupted online ordering and dozens of shops. Krispy Kreme later told regulators that data on 161,676 people was stolen. It said most were current and former staff and their families. The data included Social Security numbers, biometric data and health information.

Staff then sued, accusing the company of failing to protect their data. Krispy Kreme agreed to a $1.6 million settlement, with up to $3,500 for documented losses and credit monitoring. The settlement site says no court ruled against the company.

Its McDonald's tie-up fizzled. It reached 2,400 restaurants before both sides ended it in July 2025 over profitability. Investors filed a class action accusing executives of misleading statements about the deal. That's an allegation, and Krispy Kreme hadn't responded when it was filed.

It says it's mid-turnaround. After its Q3 2026 results, shares jumped more than 30%. That's not a good deed. Our score is low because we found little evidence of positive impact, and the data lapse hit its own workers.