Hasbro Tells Massachusetts Regulators Employee Data Was Stolen in Breach

Key points

• Hasbro filed breach notification letters with the Massachusetts Attorney General's Office this week disclosing that a compromised employee account exposed staff data.
• The Massachusetts filing lists 436 affected state residents, with Social Security numbers, financial account details, card numbers and driver's licence information among the data stolen.
• Hasbro hasn't said how many employees were affected in total, when the breach was detected, or whether customers were caught up in it.
• A separate March 28 cyberattack cost Hasbro roughly $25 million in lost revenue, according to its own financial filings; the company has not linked the two incidents.

Hasbro, the American company behind Monopoly, Nerf, Play-Doh, and Magic: The Gathering, has told Massachusetts regulators that hackers broke into an employee account and made off with personal and financial information belonging to staff.

The disclosure came through data breach notification letters filed with the Massachusetts Attorney General's Office, first reported by BleepingComputer. Hasbro didn't say how many people were affected, or when it spotted the intrusion.

What the company did say is narrow and carefully worded. "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number or national ID number," Hasbro wrote.

Regulators filled in some of the blanks. The Massachusetts Attorney General's 2026 Data Breach Notification Report records 436 Hasbro employees in the state as affected, with Social Security numbers, financial account information, credit and debit card numbers and driver's licence details among the exposed data.

How did the hackers get in?

Through a single employee account. Hasbro says it disabled that account, terminated the unauthorized access, and deployed additional safeguards. The filing doesn't spell out whether the account was taken over by phishing, where criminals send fake emails to trick staff into handing over passwords, or by stolen credentials bought from another breach. Our 7 August story on Levi's social-engineering incident showed how quickly a single compromised login can become a full network intrusion.

Account takeover is now the most common route into corporate networks. Once inside, an attacker with valid login details often looks like a legitimate user to security tools.

What does this mean for Hasbro employees?

If you work for Hasbro and live in Massachusetts, assume your Social Security number and bank details are in criminal hands. Freeze your credit with the three major bureaus, turn on transaction alerts with your bank, and watch for tax filings made in your name.

Hasbro's letters typically include an offer of free credit monitoring. Take it, but treat it as a floor. A credit freeze is stronger and free under federal law.

Is this connected to the March cyberattack?

Hasbro says no, at least not on paper. A March 28 SEC filing disclosed that a cyberattack forced systems offline, and Hasbro's subsequent financial reports put the revenue loss at around $25 million. The notification letters filed this week draw no line between the two events. Whether they're truly separate incidents, or two views of the same intrusion, is something Hasbro hasn't addressed publicly.

What legal clock is running?

There's no hard day count in the statute, but late filings have drawn Attorney General enforcement action before.

For a publicly traded company like Hasbro, the SEC's cybersecurity disclosure rule requires a Form 8-K within four business days of determining a cybersecurity incident is material. Hasbro used that mechanism for the March event. It hasn't filed one tying this employee data theft to that determination, and that gap is the detail worth watching.