Hasbro Notifies Employees of Personal Data Exposure After Network Incident

Hasbro has begun notifying current and former employees that personal information may have been accessed during a network security incident discovered earlier this year.

According to breach-notification materials submitted to the Massachusetts Attorney General's Office, the information involved differs by person but may include names, email and mailing addresses, telephone numbers, government identification numbers, and financial details. The filing indicates that 436 Massachusetts residents were affected. The overall number of people impacted has not been disclosed.

The toy and game company said it investigated the incident with assistance from external cybersecurity specialists after identifying suspicious activity on its network. Hasbro stated that the review found that certain employee records may have been accessed. It said it has not identified evidence that the affected information has been misused.

Incident may be connected to earlier disruption

The notifications follow a cyberattack reported in late March that led Hasbro to take some systems offline while it responded to the incident. Those outages disrupted operations and affected product sales.

Hasbro previously said the March event resulted in approximately $11 million in direct response and remediation costs, while system interruptions delayed an estimated $25 million in sales. The company did not directly confirm whether the employee data notifications stem from that same incident, though its statement referred to a network security event identified earlier in the year.

No cybercrime or ransomware group had publicly claimed responsibility for an attack on Hasbro or listed the company on a data-leak site at the time of the disclosure.

Support offered to affected individuals

Hasbro said it is providing identity-protection services through a third-party provider as a precaution for people whose data may have been involved. Employees who receive a notification should review the information carefully, enroll in available monitoring services, and remain alert for phishing attempts or fraudulent account activity.

• Use strong, unique passwords for financial and personal accounts.
• Enable multifactor authentication where available.
• Watch for unexpected messages seeking personal or employment information.
• Review bank and credit reports for unfamiliar activity.