Krispy Kreme, the popular US doughnut bakery, had suffered a hack that impacted its daily operations in November. It made an official SEC filing earlier this week, revealing the full scope of the breach and its impact. The company also posted a warning on the official Krispy Kreme website to warn customers.

“On November 29, 2024, Krispy Kreme, Inc. was notified regarding unauthorized activity on a portion of its information technology systems,” the filing states. “ The Company immediately began taking steps to investigate, contain, and remediate the incident with the assistance of leading cybersecurity experts.”

While the individual Krispy Kreme shops are still open, the company’s background operations have been disrupted, and certain operations have been shut down. Despite this, deliveries to bakeries and other business partners are remaining uninterrupted.

“The Company, along with its external cybersecurity experts, continues to work diligently to respond to and mitigate the impact from the incident, including the restoration of online ordering, and has notified federal law enforcement,” Krispy Kreme said. “As the investigation of the incident is ongoing, the full scope, nature, and impact of the incident are not yet known.”

It is also unclear if it was the result of ransomware, a phishing scam, or some other kind of hack. No hacking groups have claimed responsibility for the attack, although nation-state hackers from Russia and China have significantly ramped up attacks against US-based companies.

The company also expects to have reasonable financial harm from the attack, although it’s very unlikely to result in the business shutting down. Its stock price fell more than 2 percent the day the incident was reported, pointing to a clear dissatisfaction from investors.

“The Company holds cybersecurity insurance that is expected to offset a portion of the costs of the incident. The Company does not expect this will have a long-term material impact on its results of operations and financial condition.”