Hasbro Data Breach Exposes Personal and Financial Information of 436 Employees

Hasbro, one of the world’s largest toy and game companies, has disclosed a data breach that exposed non-public personal and financial information belonging to employees.

Founded in 1923, Hasbro is a NASDAQ-listed American multinational entertainment company that owns popular brands including Monopoly, Clue, Nerf, Transformers, Play-Doh, Peppa Pig, Scrabble, Magic: The Gathering, and Dungeons & Dragons.

The company filed a data breach notification with the Massachusetts Attorney General’s Office. The office did not disclose the total number of people affected or when Hasbro first discovered the incident.

“The information included will vary by individual, but may include your name and one or more additional personal information elements such as email, address, phone number, national ID number, and financial information,” Hasbro said.

Hasbro said it has taken containment and remediation steps, including disabling compromised employee accounts, stopping unauthorized access, and deploying additional security measures intended to prevent similar incidents in the future.

Although Hasbro’s breach notification did not specify the total number of affected individuals or provide a complete list of the exposed data, the Massachusetts Attorney General’s Office reported that the incident affected Social Security numbers, financial account information, credit and debit card numbers, and driver’s license information belonging to 436 Hasbro employees in Massachusetts. The information appears in the state’s 2026 Data Breach Notification Report.

A Hasbro spokesperson did not respond to BleepingComputer’s questions about whether customers were affected or whether the attackers demanded a ransom.

In early April, Hasbro disclosed a separate cyberattack. The incident disrupted company systems on March 28 and forced Hasbro to take some systems offline while it worked to recover.

In a related filing with the U.S. Securities and Exchange Commission (SEC), Hasbro warned investors that the temporary measures implemented to maintain business operations could remain in place for several weeks. The company also cautioned that the incident could cause “some delays.”

According to subsequent financial reports filed by Hasbro, the March cyberattack resulted in an estimated $25 million in lost revenue.

Hasbro has not linked the March cyberattack to the employee data breach disclosed in its filing with the Massachusetts Attorney General’s Office.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report