2026-08-28 | Toy-making giant Hasbro disclose data breach affecting employees

, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and financial information of an undisclosed number of employees. Founded in 1923, is a publicly traded American multinational entertainment conglomerate on the NASDAQ and owns many brands, including Monopoly, Clue, Nerf, Transformers, Play-Doh, Peppa Pig, Scrabble, Magic: The Gathering, Dungeons & Dragons, and many others. The company has filed data breach notification letters with the Massachusetts Attorney General's Office, but didn't disclose the total number of affected individuals or when the incident was detected. "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," said. " implemented containment and remediation measures, including disabling the compromised employee account, terminating unauthorized access, and deploying additional safeguards designed to help prevent a similar incident from occurring in the future." While the breach notification letters don't detail the total number of affected people or the nature of the information exposed in the incident, the breach affected the Social Security numbers, financial account information, credit/debit card numbers, and driver's license information of 436 employees in Massachusetts, according to the Massachusetts Attorney General's Office 2026 Data Breach Notification Report . breach listing on Mass AG site (BleepingComputer) ​A spokesperson was not immediately available for comment when BleepingComputer reached out to ask whether any customers were also affected by this breach and whether the attackers sent a ransom demand. In early April, also disclosed a cyberattack that hit its systems on March 28 and forced the company to take some of them offline while working to restore them.

In a filing with the U.S. Securities and Exchange Commission (SEC) at the time,

warned investors of "some delays," and said that interim measures taken for business continuity "may continue for several weeks before the situation is fully resolved." According to financial reports filed by since then, the company has lost approximately $25 million in revenue because of the cyberattack. didn't link the March incident with the data breach disclosed in notification letters filed with the Massachusetts attorney general's office this week. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report