Hasbro Data Breach: What We Know So Far

Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach. The disclosure comes months after a cyberattack disrupted operations at the company earlier this year.

The notifications, filed with the Massachusetts Attorney General’s Office, contain limited details. But they confirm that exposed information—which varies by individual—may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information.

It’s still unclear how many people are affected in total. The Massachusetts filing says 436 residents are impacted. Hasbro employs roughly 4,600 people worldwide, most of them in the United States, according to Revelio Labs data.

That suggests the total number could be in the hundreds or low thousands. No other state attorney general websites had published similar notifications at the time of writing.

The Link to the March Cyberattack

The timing raises an obvious question: is this connected to the cyberattack that hit Hasbro in late March? Back then, the company took some systems offline to respond, causing visible disruptions.

SecurityWeek asked Hasbro directly whether the new breach notification stems from that March incident. The company didn’t give a straight answer.

Instead, a spokesperson said Hasbro identified a security incident involving its network earlier this year and “took immediate action to address the incident.” That included launching an investigation with outside cybersecurity experts to determine what happened and what information may have been accessed.

The investigation concluded that some current and former employees’ personal information may have been accessed during the incident.

What Hasbro Is Doing Now

Hasbro says it is “not aware of any misuse of personal data” and has no indication the information will be misused. That’s the standard line in these situations, but it doesn’t mean affected employees should relax.

Out of an abundance of caution, the company is offering identity protection services through a third-party provider to those affected. If you’re a current or former Hasbro employee, that’s worth taking advantage of.

What Information Was Exposed?

According to the notification letters, the potentially exposed data includes:

• Names
• Email addresses
• Postal addresses
• Phone numbers
• National ID numbers
• Financial information

That’s a serious mix. Financial data and national ID numbers are exactly what identity thieves look for.

No Ransomware Group Has Claimed Credit

So far, no known cybercrime group has listed Hasbro on its leak website. That doesn’t rule out ransomware—many groups wait before publishing stolen data, or they negotiate quietly. But it’s a positive sign that the stolen information hasn’t been weaponized publicly.

The incident fits a broader pattern. Companies in every sector are facing similar attacks, and employee data is a prime target. If you’re tracking employee data exposure trends, this case is a textbook example of how a network intrusion can turn into a personal data nightmare.

What Employees Should Do

If you receive a notification letter from Hasbro, don’t ignore it. Here’s a practical checklist:

• Enroll in the offered identity protection services immediately
• Monitor bank accounts and credit reports for unusual activity
• Place a fraud alert on your credit file
• Change passwords on any accounts that might use the same credentials as your work accounts
• Be alert for phishing emails that reference Hasbro or the breach—scammers love to piggyback on news like this

For more on how to handle these situations, check out our guide on identity theft protection after a data breach.

The Bigger Picture

This isn’t an isolated event. Recent months have seen similar disclosures from other organizations. The ATF cyber incident after a ransomware group claimed an attack, and the Nutex Health data breach that exposed sensitive information, both show how widespread this problem has become.

Hasbro’s situation is a reminder that even household-name companies struggle with cybersecurity. The toy maker behind Monopoly, Nerf, and Dungeons & Dragons is now dealing with a very adult problem.

For affected employees, the next few months will be about vigilance. For the rest of us, it’s another data point in a troubling trend. Corporate networks are under constant attack, and when they fall, it’s often employees who pay the price.

We’ll update this story as more details emerge about the Hasbro data breach and its connection to the March cyberattack.

The Quiet Warning That Didn’t Stop the Bleed

On August 25, 2026, Cosmos Labs dropped a bombshell: a critical flaw in the shared Cosmos EVM module had been actively exploited for nearly a week. Between August 20 and August 25, attackers drained funds from six blockchains running the vulnerable code. The kicker? Cosmos Labs knew about the bug before the first exploit — and knew that every blockchain using the module was exposed.

The vulnerability, tracked as GHSA-7g4w-cg88-2cq2, is rated Critical. But here’s the odd part: it was published without a CVE identifier, without a weakness classification, and without a CVSS score. For a flaw that let attackers siphon tokens across multiple networks, that’s a glaring omission.

What the Cosmos EVM Flaw Actually Does

At its core, the bug lives in how the EVM module handles balances. Specifically, it fails to properly enforce balance checks during certain contract interactions. An attacker could craft a malicious contract that manipulates the accounting logic, effectively allowing them to spend funds they don’t own.

Think of it like a bank teller who trusts the number on a deposit slip without checking the actual cash. The attacker writes a fake slip, walks out with money, and the system never notices until it’s too late.

Affected Versions and the Patch

Cosmos Labs confirmed that all versions below 0.6.2 are vulnerable. The fix landed in version 0.6.2, which was released alongside the advisory. If you’re running anything older, you’re exposed — and given that the exploit was already in the wild, upgrading isn’t optional.

Six Blockchains Hit, but Which Ones?

Cosmos Labs hasn’t named the six affected chains. That’s frustrating for operators and users alike. What we do know is that the exploit window was tight: August 20 to August 25. That’s five days of active draining before the public advisory dropped.

The lack of transparency raises uncomfortable questions. Did Cosmos Labs wait too long to go public? Did they give chain operators a heads-up before the advisory? The advisory itself doesn’t say, and the silence is deafening.

Why the Missing CVE and CVSS Score Matters

Security researchers rely on CVE identifiers and CVSS scores to prioritize patches. Without them, teams have to manually assess the risk — a slow process when every minute counts. The advisory does include a GitHub Security Advisory ID (GHSA-7g4w-cg88-2cq2), which helps, but it’s not the industry standard.

This isn’t just bureaucratic nitpicking. A critical flaw with no CVSS score is like a fire alarm with no volume knob. You know something’s wrong, but you can’t tell how urgent it is.

Lessons for Cosmos Developers and Users

If you’re building on Cosmos, here’s what you need to do right now:

• Upgrade to Cosmos EVM module version 0.6.2 or later immediately. There is no workaround.
• Audit your contracts for any interactions with the EVM module that involve balance transfers or token accounting.
• Monitor your chain’s activity for unusual patterns between August 20 and August 25. If you see anomalies, assume the worst.
• Review the advisory GHSA-7g4w-cg88-2cq2 for technical details and indicators of compromise.

For users holding tokens on Cosmos-based chains, the advice is simpler: stay alert. If your chain was one of the six, you may be entitled to information from the team — but don’t hold your breath for compensation.

The Bigger Picture: Shared Code, Shared Risk

This incident highlights a fundamental tension in the blockchain world. Shared modules like the Cosmos EVM bring efficiency and interoperability, but they also create a single point of failure. One bug in a shared module can compromise dozens of chains at once.

Cosmos Labs’ advisory is a stark reminder that security in the Cosmos ecosystem is only as strong as its weakest link. And right now, that link was the EVM module.

For more on how similar exploits have shaped the ecosystem, check out our coverage of cross-chain bridge security and Cosmos ecosystem vulnerabilities.

Berlin officials confirm extortion attempt after August cyberattack

Berlin’s state government has officially confirmed it is the target of an extortion attempt. The admission comes weeks after hackers compromised the city’s administrative network in August. But officials are drawing a hard line: they won’t pay.

The statement, released by the Senate, also revealed that forensic investigators uncovered additional data outflows. The latest discovery involves the Senate Department for Mobility, Transport, Climate Protection and Environment. That’s a significant expansion of the breach’s scope.

So far, the city has not specified the exact nature of the stolen data. Nor have officials named the attackers. But the message is clear: Berlin will not negotiate.

Why Berlin is refusing to pay the ransom

It’s a decision that carries real consequences. Refusing to pay often means the stolen data gets published online. Yet cybersecurity experts have long argued that giving in to hackers only fuels the cycle.

“Paying ransoms doesn’t guarantee data recovery,” says one Berlin-based IT security analyst familiar with the case. “And it paints a target on your back for future attacks.”

The city’s stance aligns with broader German government policy. Federal authorities have repeatedly discouraged ransom payments to cybercriminals. The logic is straightforward: if everyone pays, the attacks will never stop.

The breach: what we know so far

The August attack hit the city’s state administrative network, a system that handles sensitive data across multiple departments. Initial reports suggested a limited compromise. Now, officials admit the damage may be deeper.

The newly confirmed data outflow from the transport and environment department raises serious questions. That department manages everything from public transit contracts to climate policy documents. If that data lands in the wrong hands, the fallout could be significant.

Forensic teams are still working to determine the full extent of the leak. The city has not provided a timeline for when the investigation might conclude.

What data was stolen?

Officials haven’t disclosed specific details. But based on typical attacks of this nature, the stolen data could include:

• Employee records and internal communications
• Contract documents and vendor information
• Project plans related to transport and environmental initiatives
• Potentially sensitive citizen data

Until the forensic analysis is complete, the full picture remains unclear.

How Berlin is responding to the cyberattack

The city has activated its crisis response protocols. IT teams are working around the clock to secure affected systems and prevent further unauthorized access.

Authorities have also notified the relevant data protection officers. That’s a legal requirement under German and EU regulations when personal data is compromised.

Public communication has been measured. Officials are balancing transparency with operational security. Sharing too much could tip off the attackers or expose additional vulnerabilities.

For residents and businesses that interact with the city’s digital services, the advice is to remain vigilant. Watch for suspicious communications that might reference data obtained from the breach.

The bigger picture: ransomware and public institutions

Berlin is far from alone in facing this dilemma. Public institutions across Germany and Europe have become prime targets for cybercriminals. The attacks are often opportunistic, exploiting known vulnerabilities rather than targeting specific victims.

But public entities face a unique pressure. They hold data on millions of citizens. A leak can expose personal information, financial records, and confidential government operations. The stakes are enormous.

Some cities have paid ransoms in the past, hoping to minimize damage. Others, like Berlin, have chosen to resist. The debate over which approach is more effective continues to divide experts.

What’s certain is that the threat isn’t going away. Municipalities across Germany are now reviewing their own cybersecurity postures, wondering if they could be next.

What happens now for Berlin?

The immediate focus is on damage control. Forensic teams continue their work. Law enforcement and federal cybersecurity agencies are likely involved in the investigation.

Longer term, the city will need to answer tough questions. How did the attackers get in? Were there warning signs that went unheeded? What steps will be taken to prevent a repeat?

Public trust is also on the line. Berlin residents expect their government to protect their data. A breach of this scale tests that confidence.

For now, the city’s position is firm. No ransom. No negotiation. Whether that decision proves wise will depend on what the hackers do next.

The coming weeks will be telling. If the stolen data appears online, the city will face a public relations crisis. If the attackers move on, Berlin’s resolve will have paid off.

Either way, this case is a stark reminder: no institution, however well-funded, is immune to cyber threats. And the choice to pay or not to pay is never easy.