Hasbro data breach: a vishing campaign, systems offline, and letters six months later

Date	Event
March 27 to 28, 2026	Unauthorized actor in Hasbro systems with credentials obtained by vishing
March 28, 2026	Hasbro identifies the intrusion and takes systems offline
April 1, 2026	Form 8-K, Item 8.01, filed with the SEC
April 3, 2026	A separate actor uses information from the first compromise to access an employee's account
April 4, 2026	Hasbro disables that account; containment complete; primary data center taken offline for restoration
August 25, 2026	Report to Massachusetts (2026-1427): 436 residents
September 23, 2026	File review finds New Hampshire residents' data
September 30, 2026	Letters by first-class mail begin
October 7, 2026	Notice to New Hampshire: 15 residents

What happened in the Hasbro cyberattack?

The 8-K describes the first days. Hasbro activated its incident response, took certain systems offline, brought in third-party cybersecurity professionals, and ran business continuity plans so it could keep taking orders and shipping product. Its newsroom update of April 4 said orders were shipping, including Magic: The Gathering and toys and games. It also said Hasbro Pulse, D&D Beyond and Magic: The Gathering Arena were not affected. TechCrunch reported on April 1 that parts of Hasbro's website appeared to be down and that the company would not say whether the attackers had made a demand.

The New Hampshire notice, filed six months later, adds the cause and a second intrusion. The first actor got valid credentials by vishing, which means phone calls that talk staff into giving up access, plus other social engineering. Then, on or about April 3, a different actor used information from the first compromise to get into an employee's Hasbro account. Hasbro found that on April 4, disabled the account, and says it has no evidence of access after that day. Containment ended that day, when the company also took its primary data center offline for restoration.

Who got a Hasbro breach letter, and what was exposed?

The documents do not say whether the people affected are employees, customers or business partners. The Massachusetts letter says the data varied by person but may include name plus email, address, phone number, national ID number or financial information. The Massachusetts row marks Social Security numbers, financial accounts, driver's licenses and credit or debit card numbers. The 8-K said Hasbro was reviewing the files possibly involved, and the New Hampshire notice says that review was still going on in October.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1427	436	Social Security numbers, financial accounts, driver's licenses, card numbers
New Hampshire DOJ notice, October 7, 2026	15	Personal information in the affected files

Why did letters take six months?

Hasbro's counsel says the review of the affected files is what took time: it was on September 23, 2026 that Hasbro found New Hampshire residents' data in them, and the review was still continuing. The Massachusetts report came first, on August 25. More states may follow. The notice delay guide compares gaps like this one, and the Item 8.01 versus 1.05 guide explains why a company files under 8.01 rather than 1.05.

What is Hasbro offering?

Complimentary identity protection through Epiq's Privacy Solutions ID, at privacysolutionsid.com or 866.675.2006, Monday to Friday, 9:00 a.m. to 5:30 p.m. Eastern, with the code and deadline in the letter. Enrollment is for people 18 and older. Hasbro's own questions line is 888-780-5138, Monday to Friday, 6:00 a.m. to 6:00 p.m. Pacific. The letter also warns readers to watch for phishing emails, which fits an attack that began with social engineering. For how these offers compare, see the credit monitoring guide.

What the documents leave open

• Who the two actors were, and whether either made a ransom demand.
• Whose records were in the affected files: employees, customers or partners.
• The total number of people notified once the review ends.