Hasbro data breach exposed personal information of 600 RI residents

The personal information of more than 600 Rhode Island residents who worked for or bought products from Hasbro Inc. may have been exposed during a two-part data breach earlier this year, according to an Oct. 7 email sent to the Rhode Island Attorney General’s office and shared with Rhode Island Current.

The notice comes more than six months after the Pawtucket toy and gaming company first reported to federal regulators that hackers had accessed its security network. But on Sept. 23, as part of a review of files accessed during the March 28 breach, the company determined the breach affected Rhode Island residents, Daniel Goldberg, a data lawyer with Frankfurt Kurnit Klein & Selz, wrote in the email to AG Peter Neronha’s office.

State law requires any data breaches that compromise the personal information of more than 500 Rhode Islanders to be reported to the Rhode Island Office of the Attorney General within 45 days. 

In initial press releases and financial reports addressing the data breach, Hasbro executives offered little information about the cyberattack.

In late August, Hasbro notified Massachusetts’ attorney general that 436 Commonwealth residents were affected, according to news reports. Information on the impact for residents of other states was not immediately available.

The notice to the AG’s office also references a second piece of the breach that occurred five days later, on April 3, when a “separate, unauthorized actor” used information from the previous hacker to break into an employee’s account. 

“Remediation measures were deployed the same day, and Hasbro has implemented additional safeguards to help prevent a similar incident in the future,” Goldberg wrote.

Hasbro notified 608 Rhode Island residents through letters sent Sept. 30 via first-class mail that their Social Security numbers, driver’s license numbers and financial and account information may have been exposed, Goldberg wrote. The letters also include instructions for complimentary credit monitoring and identity theft protection.

However, a class action lawsuit filed in Rhode Island federal court in April accuses the company of having done “little if anything” to protect the personal information of the “thousands” employees and customers affected across multiple states. Hasbro has not yet responded to the complaint, having requested extensions three times. Its most recent request, submitted Sept. 9, states the parties may be resolving the case through mediation.

A spokesperson for Hasbro did not immediately respond to requests for comment Thursday. Goldberg also did not immediately respond to requests for information.

In a call with investors in April, Hasbro executives expressed confidence that they have shored up the systems against future hacks, spending more than $20 million in legal bills and security protections. A temporary operational shutdown immediately after the breach was expected to cost another $60 million in delayed income, they said on the call.

The company is expected to finish moving its headquarters to the Boston Seaport by the end of the year, with plans to list its Pawtucket office for sale once the move is completed. The century-old Rhode Island company employed roughly 700 people in Rhode Island before beginning the relocation earlier this year.