Hasbro says it may take weeks to recover from major IT security incident

American multinational toy manufacturing company Hasbro said it suffered a major cyber attack in late March which forced it to take some systems offline and put in place business continuity plans that could last several weeks.

 

The multinational toy manufacturer, which reported an annual revenue of $4.1 billion in 2025, announced the cyber security incident in an 8K filing with the U.S. Securities and Exchange Commission on Wednesday, stating that it detected unauthorised access to its systems on March 28.

 

Upon detecting the unauthorised activity, the company activated its security incident response protocols, took certain systems offline, implemented additional containment measures and launched an investigation with help from third party cyber security specialists.

 

Founded in 1923 and headquartered in Pawtucket, Rhode Island, Hasbro is known for producing highly popular toy products like Transformers, G.I. Joe, Power Rangers, Rom the Space Knight, and Micronauts. The company also sells popular puzzles, board games, wargames, role-playing games and sports equipment.

 

The company informed the SEC that in response to the cyber attack, it has activated business continuity plans to continue to take orders, ship product and conduct other key operations while it resolves this situation as it works towards resolving the fallout of the attack.

 

"The need to run these interim measures may continue for several weeks before the situation is fully resolved and may result in some delays," Hasbro said. 

 

"The Company is also working to identify and review the files potentially impacted and will take additional actions as appropriate based on its review and findings, including providing any notifications deemed necessary under applicable law. The company will continue to implement measures to secure its business operations and take additional steps as appropriate," it added.

 

The company has not mentioned whether it is dealing with a ransomware incident or if it has been able to identify the attackers. The company has also not mentioned in its 8K filing if the cyber security incident affected the personal information of employees or customers.

 

The news arrives after another major toy retailer, Toys “R” Us Canada, suffered a data breach in June 2025 that involved malicious actors stealing customers’ names, physical addresses, email addresses, and phone numbers and posting the stolen database on the dark web. At the time of the incident, the company operated about 40 stores across Canada, selling toys, games, and children’s apparel.