Hasbro

Summary

Hasbro identified unauthorized access to its corporate network and later confirmed that employee personal and financial information had been exposed, affecting at least 436 residents of Massachusetts with data such as names, Social Security numbers, financial account details, credit and debit card numbers, and driver’s license information. The breach stemmed from a compromised employee account, involved no malware or ransomware, and led to the company taking some systems offline, causing operational delays and reporting $11 million in direct costs and approximately $25 million in lost revenue; the company disabled the affected account, engaged third‑party investigators, and offered credit monitoring to impacted individuals while stating it had no evidence of data misuse.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 28, 2026, Hasbro identified unauthorized access to its corporate network and promptly activated its incident response procedures. The company filed a Form 8‑K with the U.S. Securities and Exchange Commission on April 1, 2026, disclosing the intrusion and noting that recovery could take several weeks. As part of its response, Hasbro took certain systems offline while implementing business continuity plans to maintain order processing, shipping and other key operations. The firm engaged third‑party cybersecurity professionals to investigate the scope of the incident and to determine whether any files had been compromised. On April 4, 2026, Hasbro posted a cybersecurity incident update to its corporate newsroom, and on April 23, 2026 it filed a second 8‑K providing further detail on the incident’s scope. In mid‑to‑late April 2026 a class‑action complaint titled Standing v. Hasbro was filed in the U.S. District Court for Rhode Island. On May 11, 2026 Hasbro submitted an NT 10‑K filing that delayed its quarterly report and confirmed that the unauthorized access had been contained and did not affect first‑quarter financial results. By June 28, 2026 the company reported $11 million in direct incremental expenses and approximately $25 million in lost revenue attributable to the incident for the three and six months ended that date.

On August 28, 2026 Hasbro began mailing data breach notification letters to affected employees, and contemporaneously filed those notices with the Massachusetts Attorney General’s Office. The Massachusetts AG’s 2026 Data Breach Notification Report indicated that 436 residents of the state had personal and financial information exposed in the breach. The notification letters stated that the information involved varied by individual and could include names, email addresses, postal addresses, phone numbers, national ID numbers, or financial information. For the Massachusetts residents specifically, the exposed data comprised Social Security numbers, financial account information, credit or debit card numbers, and driver’s license information. Hasbro stated that it was not aware of any misuse of the personal data and had no indication that the information would be misused. As a precautionary measure, the company offered identity protection services through a third‑party provider to those individuals whose data was compromised. The investigation determined that the breach originated from a compromised employee account, with no evidence of malware deployment, ransomware encryption, or public extortion attempts. No technical indicators of compromise or threat actor attribution have been publicly released as of August 2026. Consumer‑facing platforms such as Hasbro Pulse, D&D Beyond, and Magic: The Gathering Arena remained operational and were not affected by the intrusion.

Sources

Sources available to members: 11 sources.