The Hasbro Company has notified its employees that their personal information could have been exposed as a result of a data breach involving one of their compromised employee accounts. The company informed the Massachusetts Attorney General's Office of the incident in breach notification letters.
As indicated in the notices, the information involved varies according to the individual and can include names, email addresses, postal addresses, phone numbers, national identification numbers, and financial information. Hasbro has not provided any information about the number of individuals affected or the date of discovery of the breach.
It has been reported that, according to records published by the Massachusetts Attorney General's Office, 436 residents of the state were affected.
The company has approximately 4,600 employees worldwide, with a significant number based in the United States. Hasbro may have suffered a cyber attack in late March that resulted in the company shutting down several systems. While working to contain the cyberattack, the disruption affected its operations.
Immediately following the incident, Hasbro disabled the compromised employee account, terminated unauthorized access, and implemented additional security measures. There has been no public disclosure of how the account was compromised or whether attackers were able to access the exposed information.
Among the information affected by the breach in Massachusetts was the social security number of the employee, financial account details, credit card information, and driver's license data.
Details of Hasbro Breach Remain Limited
It has not been disclosed by Hasbro how the employee account was compromised, the duration of the unauthorized access, or whether the information was actually removed from its systems. Based on the company's notification, it appears that the information involved differs between affected individuals, making it difficult to establish the exact scope of the exposure.
Furthermore, it has been raised that the incident may have extended beyond employee records.
Public reporting has not established whether customer information was accessed, nor has a ransom demand or the identity of the attackers been confirmed. The employee data incident occurs months after Hasbro released a separate cyberattack on March 28 that compromised its data.
Due to that attack, some of the company's systems were taken offline, disrupting manufacturing, shipping and order processing.
Hasbro warned that delays could continue for weeks and hired third-party forensic specialists to investigate the incident. Although there is no indication that the March attack was directly related to the employee data breach, the available reporting does not suggest a direct link.
If Hasbro does not provide evidence linking the two incidents, it is more accurate to treat the two incidents as separate events.
Hasbro's disruption extended beyond corporate systems, affecting the company's ability to produce products, ship orders, and process new orders as well. However, the March attack nonetheless illustrates the broader impact a compromise can have on a major manufacturer.
In the case of employees whose Social Security numbers, financial details, payment card information, or driver's license data was compromised, the consequences could extend beyond the initial disclosure.
Identity theft, fraudulent transactions, targeted phishing campaigns, and attempts to gain access to other accounts can all be perpetrated using this information. As a result of the compromised employee account being disabled, unauthorized access was ended, and additional safeguards were implemented.
There have been no additional public details provided by the company regarding the technical cause of this compromise or the procedure used to determine the full extent to which the data was exposed.
Hasbro Provides Protection Services to Affected Employees
Upon conducting an investigation with the assistance of external cybersecurity specialists, Hasbro concluded that personal information belonging to current and former employees may have been accessed during the incident. Hasbro reported that there are no indications of misuse of the exposed information at the time. As a precaution, Hasbro is offering identity protection services to affected individuals through a third-party provider.
The company advised those affected to monitor their account statements as well as obtain their free credit reports in order to detect any unusual activity. Following the investigation, Hasbro said additional safeguards were implemented. The circumstances surrounding the exposure remain unclear. Hasbro has not confirmed whether customer information was exposed, nor has it made any disclosure as to whether ransom was demanded by the attackers.
A threat actor has also not been publicly identified by the company. A question was made regarding whether the employee-data exposure was related to the March cyberattack, but Hasbro did not confirm an association between the two incidents. Hasbro suffered significant financial losses as a result of the earlier attack.
Approximately $25 million was lost from revenue as a result of operational disruptions, and approximately $11 million was spent responding to and cleaning up the incident directly.
As no further information has been released regarding the compromised account or the number of individuals affected, it is unclear as to the extent of the employee-data exposure.
Despite Hasbro's latest disclosure confirming employee information was compromised, key questions about the intrusion and its relationship with the earlier cyberattack remain unanswered.
In light of this incident, it becomes evident that compromised employee accounts pose serious risks as well as the potential impact of unauthorized access to sensitive workforce data. In order to determine the full scope of the breach, Hasbro will need to conduct a thorough investigation and implement protective measures.
