Data Breaches & Leaks SecurityWeek 1 month ago

Hasbro Data Breach Exposed Employee Personal Information

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Data & Identity Stores
Intelligence Sector
Data Breaches & Leaks

Analyst Takeaway

"Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach. The notifications sent to affected individuals contain little detail, but they indicate that the exposed information, which varies by individual, may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information. The..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Hasbro cyberattack

Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach.

The notifications sent to affected individuals contain little detail, but they indicate that the exposed information, which varies by individual, may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information. 

The information comes from notification letters that Hasbro submitted to the Massachusetts Attorney General’s Office. 

It’s unclear how many individuals are affected in total, but it’s likely hundreds or a few thousand. The Massachusetts notification says 436 residents are impacted and the company has roughly 4,600 employees worldwide, most in the United States, according to Revelio Labs data.

Data breach notifications do not appear to have been published on any other AG website at the time of writing.

The data breach may be related to the cyberattack that targeted Hasbro in late March. The company took some systems offline to respond to the attack, resulting in disruptions. 

Advertisement. Scroll to continue reading.

SecurityWeek asked Hasbro to confirm whether the new breach notification is connected to the March cyberattack. The company did not directly answer that question.

Written By Eduard Kovacs

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →