Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach.
The notifications sent to affected individuals contain little detail, but they indicate that the exposed information, which varies by individual, may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information.
The information comes from notification letters that Hasbro submitted to the Massachusetts Attorney General’s Office.
It’s unclear how many individuals are affected in total, but it’s likely hundreds or a few thousand. The Massachusetts notification says 436 residents are impacted and the company has roughly 4,600 employees worldwide, most in the United States, according to Revelio Labs data.
Data breach notifications do not appear to have been published on any other AG website at the time of writing.
The data breach may be related to the cyberattack that targeted Hasbro in late March. The company took some systems offline to respond to the attack, resulting in disruptions.
The cyberattack cost Hasbro $11 million in direct cleanup expenses and delayed another $25 million in product sales due to system shutdowns.
SecurityWeek asked Hasbro to confirm whether the new breach notification is connected to the March cyberattack. The company did not directly answer that question.
A Hasbro spokesperson said the company identified a security incident involving its network earlier this year and “took immediate action to address the incident,” including launching an investigation with outside cybersecurity experts to determine what happened and what information may have been accessed.
The investigation determined that some current and former employees’ personal information may have been accessed during the incident. Hasbro said it is “not aware of any misuse of personal data” and has no indication the information will be misused.
Out of an abundance of caution, the company said it is offering identity protection services through a third-party provider to those affected.
No known cybercrime group has listed Hasbro on its leak website.
*added information on financial loss caused by the cyberattack
Related: ATF Confirms Cyber Incident After Ransomware Group Claims Attack
Related: Sensitive Information Exposed in Nutex Health Data Breach
Related: Personal Information Exposed in Apollo Global Data Breach
