Create

JPMorgan

BlackRock

would

When a company gets breached these days, the cleanup bill rarely stops at fixing the systems that were broken into.&nbsp;
Companies end up paying for legal settlements, customer reimbursements, identity protection services, and years of trying to win back people who no longer trust them with their data.
IBM's <a href="https://www.ibm.com/reports/data-breach" rel="noopener noreferrer nofollow">2025 Cost of a Data Breach Report</a> put the average breach at $10.22 million for a U.S. company, the highest figure the firm has ever recorded. A recent settlement at Krispy Kreme and an ongoing mess at Coinbase show what those costs actually look like on the ground.
<a href="https://www.thestreet.com/crypto/markets/treasury-reveals-bold-new-proposal-for-u-s-dollar-bill" rel="noopener noreferrer nofollow">Related: Treasury officials push for a $250 bill featuring Trump's face</a>
<h2 id="krispy-kreme-settlement-reveals-cyberattack-costs">Krispy Kreme settlement reveals cyberattack costs</h2>
Krispy Kreme is the North Carolina-based doughnut and coffee chain founded in 1937, with more than 1,400 shops worldwide and a presence in grocery stores and gas stations across the U.S. It trades publicly on the Nasdaq under the ticker DNUT.
The company agreed to a $1.6 million settlement over a November 2024 <a href="https://www.insurancejournal.com/news/national/2024/12/11/804373.htm" rel="noopener noreferrer nofollow">data breach</a> that affected 161,676 people, per breach and <a href="https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0c411aee-5d5d-45bc-b6ad-ec41ce2bfdda.html" rel="noopener noreferrer nofollow">settlement records</a>.
Here is what eligible people can claim:
<ul>
 <li>Up to $3,500 for documented losses tied to fraud or identity theft</li>
 <li>An estimated $75 cash payment for those without documented losses</li>
 <li>One year of free credit monitoring for everyone eligible</li>
</ul>
The breach exposed names, dates of birth, Social Security numbers, and financial account details.
Claims have to be filed online or postmarked by June 22, 2026. The online portal is <a href="https://krispykremedatasettlement.com/Login" rel="noopener noreferrer nofollow">here</a>. Mail-in claims go to the Krispy Kreme Data Incident Settlement Administrator, PO Box 2047, Portland, OR 97208-2047.
Krispy Kreme has <a href="https://www.latimes.com/business/story/2026-05-27/krispy-kreme-customers-could-get-3-500-in-payouts-after-data-breach" rel="noopener noreferrer nofollow">denied wrongdoing</a>, and the settlement resolves the case without a court finding the company liable.
The company said it became aware of "unauthorized activity" on part of its IT systems on Nov. 29, 2024, and "immediately began taking steps to investigate, contain, and remediate the incident."
<h3 id="most-popular-on-thestreet-roundtable">Most Popular on TheStreet Roundtable:</h3>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/jpmorgan-reveals-spending-20-billion-on-an-acquisition" rel="noopener noreferrer nofollow">JPMorgan reveals wanting to spend $20 billion on an acquisition</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/treasury-reveals-bold-new-proposal-for-u-s-dollar-bill" rel="noopener noreferrer nofollow">Treasury reveals bold new proposal for U.S. dollar bill</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/mysterious-trader-dumps-1b-from-blackrock-etf" rel="noopener noreferrer nofollow">Mysterious trader dumps $1B from BlackRock ETF</a></li>
</ul>
<h2 id="coinbase-breach-showed-crypto-firms-face-same-risks">Coinbase breach showed crypto firms face same risks</h2>
Retail brands are not the only ones dealing with this. Crypto companies are getting hit the same way, and when they do, the numbers run a lot higher.
On May 15, 2025, <a href="https://www.coinbase.com/en-in/blog/protecting-our-customers-standing-up-to-extortionists" rel="noopener noreferrer nofollow">Coinbase said</a> criminals had bribed and recruited rogue overseas support agents to steal customer data, which they then used to run social engineering attacks. The company said passwords, private keys, funds, and wallets were never compromised.
The attackers demanded $20 million to keep quiet. <a href="https://www.thestreet.com/crypto/tag/coinbase" rel="noopener noreferrer nofollow">Coinbase</a> turned them down.
<blockquote>
 "We said no," Coinbase, on the $20 million extortion demand
</blockquote>
The company said it would not fund criminal activity. Instead, it laid out a different plan:
<ul>
 <li>Reimburse customers who were tricked into sending funds</li>
 <li>Fire the insiders involved</li>
 <li>Work with law enforcement</li>
 <li>Create a $20 million reward fund for information leading to arrests</li>
</ul>
Coinbase later estimated the incident could cost between $180 million and $400 million in remediation and voluntary <a href="https://www.wired.com/story/coinbase-will-reimburse-customers-up-to-400-million-after-data-breach/" rel="noopener noreferrer nofollow">customer reimbursements</a>.
If you believe your personal information was exposed in a breach, official claim details are usually available through your state attorney general's office or the settlement administrator named in any notice you receive.
<a href="https://www.thestreet.com/crypto/markets/michael-burry-drops-bombshell-on-spacex-openai-anthropic-ipos" rel="noopener noreferrer nofollow">Related: Michael Burry drops bombshell on SpaceX, OpenAI IPOs</a>

Americans to recieve $3,500 each after doughnut chain settles lawsuit

Table of Contents

TheStreet Roundtable

Other articles published on May 28, 2026

Join our free newsletter for daily crypto updates!