DisclosureLens
Social EngineeringRetail & ConsumerRetailVishingStolen CredentialsMulti-Stage ChainData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountCredentialsMediumContained

Hasbro, Inc.

bd_c74311ca03923b7d · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 28, 2026

Filed

Oct 7, 2026

To disclose

28 weeks

Affected

608state residents only

Linked

2 filings

Confidence

68%
Full breach record for Hasbro, Inc. →5 incidents on file

Hasbro, Inc. notified the Rhode Island Attorney General of a data incident involving unauthorized access to its network. An external actor obtained valid credentials via a vishing and social engineering campaign, accessing systems between March 27-28, 2026. A second actor accessed an employee account on April 3, 2026, which was disabled on April 4, 2026. Approximately 608 Rhode Island residents were affected, with data including SSNs, driver's licenses, financial account info, and credentials. Hasbro engaged forensic specialists, notified law enforcement, and began sending notification letters on September 30, 2026, offering credit monitoring.

Incident timeline

undetected · 1 days
discovery → filing · 28 weeks / 193 days

Mar 27, 2026

Begins

Mar 28, 2026

Discovered

Oct 7, 2026

Filed

vs. sector median

+18 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings · 2 states

View merged incident ↗
Vermont State AGOct 7 · first
Rhode Island State AGOct 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.