Item 1.05. Material Cybersecurity Incidents.

On November 29, 2024, Krispy Kreme, Inc. (the “Company”) was notified regarding unauthorized activity on a portion of its information technology systems.^¹,²,³ The Company immediately began taking steps to investigate, contain, and remediate the incident with the assistance of leading cybersecurity experts.^⁴

Krispy Kreme shops globally are open, and consumers are able to place orders in person, but the Company is experiencing certain operational disruptions, including with online ordering in parts of the United States. Daily fresh deliveries to our retail and restaurant partners are uninterrupted.^⁵

The Company, along with its external cybersecurity experts, continues to work diligently to respond to and mitigate the impact from the incident, including the restoration of online ordering, and has notified federal law enforcement. As the investigation of the incident is ongoing, the full scope, nature, and impact of the incident are not yet known.^⁶

As of the date of this filing, the incident has had and is reasonably likely to have a material impact on the Company’s business operations until recovery efforts are completed^⁷,⁸. The expected costs related to the incident, including the loss of revenues from digital sales during the recovery period, fees for our cybersecurity experts and other advisors, and costs to restore any impacted systems, are reasonably likely to have a material impact on the Company’s results of operations and financial condition^⁹,¹⁰. The Company holds cybersecurity insurance that is expected to offset a portion of the costs of the incident. The Company does not expect this will have a long-term material impact on its results of operations and financial condition^¹¹.

Cautionary Note Regarding Forward-Looking Statements

This Form 8-K contains forward-looking statements that involve risks and uncertainties. The words “continues,” “experiencing,” “expect,” “ongoing,” or similar words, or the negative of these words, identify forward-looking statements. Such forward-looking statements are based on certain assumptions and estimates that we consider reasonable but are subject to various risks and uncertainties relating to our operations, financial results, financial conditions, business, prospects, growth strategy and liquidity. Accordingly, there are, and may be, important factors that could cause our actual results to differ materially from those indicated in these statements. The inclusion of this forward-looking information should not be regarded as a representation by us that the future plans, estimates or expectations contemplated by us will be achieved. The final outcome of this matter could differ materially from the forward-looking statements included herein. Factors that could cause actual results to differ from those expressed in forward-looking statements include, without limitation, the risks and uncertainties described under the headings “Cautionary Note Regarding Forward-Looking Statements” and “Risk Factors” in our Annual Report on Form 10-K for the year ended December 31, 2023, filed by us with the Securities and Exchange Commission (“SEC”) and described in the other filings we make from time to time with the SEC. We believe that these factors include, but are not limited to, the completion of the Company’s investigation into the incident, the ultimate results and timing of the Company’s containment and remediation efforts, the final amount of costs related to the incident, the insurance coverage available to offset our costs, and the potential impact on the Company’s business operations, results of operations, and financial conditions. These forward-looking statements are made only as of the date of this document, and we do not undertake any obligation, other than as may be required by applicable law, to update or revise any forward-looking or cautionary statement to reflect changes in assumptions, the occurrence of events, unanticipated or otherwise, or changes in future operating results over time or otherwise.