FEDERALHackingRetail & ConsumerRetailCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

JAKKS Pacific, Inc.

bd_0872ddea9ecfa426 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 1, 2022

Filed

Mar 2, 2026

To disclose

40 months

Affected

Not disclosed

Confidence

64%

Full breach record for JAKKS Pacific, Inc. →4 incidents on file

JAKKS Pacific disclosed in its 2022 10-K (Item 1C) that in December 2022, it learned of a cybersecurity threat where employee personal data was extracted from its IT systems. The company investigated, engaged third-party forensic experts and legal counsel, and implemented containment protocols. No material damage was identified.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d40 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 40 months / 1187 days

Dec 1, 2022

Discovered

Mar 2, 2026

Filed

vs. sector median

+162 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

A leak claim by cl0p about this victim predates this filing by 433 days.View originating leak claim

Name: JAKKS Pacific, Inc.
norm: jakks pacific
Domain: jakks.com

Name: JAKKS Pacific, Inc.
norm: jakks pacific
SEC CIK: 1009829
Domain: jakks.com
Industry: Retail & Consumerllm

Discovered: Dec 1, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External

During the incident: Launched an investigation
Undertook prompt action, including employing containment protocols to mitigate the impact of the threat
Engaging third-party information technology cyber security and forensics experts and special legal counsel
Utilizing additional security measures to help safeguard the integrity of its IT System’s infrastructure and the data contained therein
Changes made: Adopted a cybersecurity framework to help manage and mitigate cybersecurity risks
Implemented cybersecurity policies, processes and procedures to aid in the identification, protection, detection of cyber related issues, and the response to and recovery from cybersecurity breaches
Established a subcommittee of the Board of Directors to oversee and manage the company’s risk, response, and recovery policies, processes, and procedures related to, and stemming from, cyber-related issues
Purchased cybersecurity risk insurance to protect against potential losses arising from a cybersecurity incident
Implementation of weekly vulnerability and semi-annual penetration tests to identify, and if necessary, remediate, any potential risk to the organization
Maintain and review annually a Business Continuity Plan and Cyber Attack Plan
Implemented a revised and updated phishing email training program semi-annually
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 months(1187 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1009829/000118518526000723/jakk10k123125.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 2, 2026
Raw hash: ccd935de770fa42547ca7de6558a80e262c7e54ba589dba447188d1e6c25dd6c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.5 MB

Download View at source

Reporting entityJAKKS Pacific, Inc.

Victim entityJAKKS Pacific, Inc.

Incidentdiscovered Dec 1, 2022

Stated responseLaunched an investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing