2026 Hasbro — Mar vishing intrusion; MA 436 + RI 608 resident notices (SSNs/DLs/financial)
Data compromised
Per MA/RI notices: may include SSNs, driver’s license numbers, financial/payment-card information, usernames/emails/passwords (varies). Known state counts: 436 Massachusetts + 608 Rhode Island; nationwide total unpublished.
Technical writeup
Verified state AG notices — Hasbro’s March 28, 2026 network incident (SEC Apr 1) involved credentials obtained via vishing/social engineering (access ~Mar 27–28) plus a separate Apr 3–4 employee-account follow-on. Massachusetts AG letters (~Aug 28) cited 436 residents. Rhode Island AG notice dated October 7, 2026 (letters mailed beginning Sep 30) states 608 RI residents may be affected; categories may include SSNs, driver’s licenses, financial/payment-card data, and usernames/emails/passwords. Nationwide census unpublished — recordsAffected 1044 sums published MA+RI state counts only.
Root cause
Unauthorized access via compromised employee account; company disabled account and remediated (Massachusetts AG notice Aug 2026)
References
- https://www.bleepingcomputer.com/news/security/toy-making-giant-hasbro-disclose-data-breach-affecting-employees/
- https://riag.ri.gov/news-events/data-breach-notifications
- https://rhodeislandcurrent.com/wp-content/uploads/2026/10/Rhode-Island-Breach-Notification-AG-Letter12305406.1_Redacted.pdf
- https://www.newsfromthestates.com/article/hasbro-data-breach-exposed-personal-information-600-ri-residents
- https://www.sec.gov/Archives/edgar/data/0000046080/000004608026000013/has-20260401.htm