What the Recent Hasbro Filing Teaches a Greater Boston Firm About One Phone Call
Hasbro is one of the most widely recognized brands based in New England. It has a large technology team, outside advisors, and a new headquarters moving from Pawtucket, RI to the Boston Seaport in January, 2027. But last March, it was hit by a cyberattack, and new details released over the past month show how the attackers got in, how long recovery took, and what it cost.
Though operating on a far smaller scale, I think the lessons learned apply directly to the firms I work with in Newton, Waltham, and across Greater Boston. A 25-person regional accounting firm will have different security needs and protocols than a 4500+ employee global brand, but when the breach stems from a single phone call, the concerns and vulnerabilities become universal.
What Happened at Hasbro
On March 28, Hasbro found an intruder inits network. In a notice filed with Massachusetts regulators in late August, the company said the attack came from a “vishing and social engineering campaign.”
Vishing is the industry term for voice phishing, where instead of a suspicious email, someone calls seeking company information. They may sound like a coworker in a different department, avendor, or the IT help desk itself. They ask for a password, a login code, or a quick reset. Nothing gets hacked the way it might be depicted in a movie, someone with their guard down is simply talked into opening the door.
Here is what Hasbro’s own filings and the Boston Business Journal report show:
Hasbro brought in outsidecybersecurity, forensic, incident response, and ransomware response specialists.
It took its primarydata center offline until it could be completely rebuilt.
While systems were restored, it processed orders by hand at a reduced rate.
About a week after the first breach, a separate attacker used gathered information to get into an employee account.
Social Security numbers, financial account numbers, card numbers, and driver’s license information for 436 Massachusetts residents were exposed.
Normal order processing, shipping, and invoicing did not return until June 28, about three months after the attack.
Hasbro has reported nearly $11 million in direct costs and about $25 million in lost revenue. A class action lawsuit was also filed in federal court in April.
Hasbro did a lot of things right. It had aresponse plan, it acted quickly, and it had experts to call on. Recovery still took months and will have a lasting effect on security, morale, and the bottom line.
Three Lessons for a Smaller Firm
1. Opening the front door is often just a phone call away
Firewalls and email filters matter. They do not answer the phone. The simplest habit I recommend is—if someone calls asking for a password, a login code, a reset, or a change to payment details, hang up andcall back on a number you already know. A real colleague will not mind. Neither will a real vendor.
The same rule belongs at the help desk. Whether yourIT support is in house or outside, nobody should reset a password or amultifactor login based on a phone call alone. The federal Cybersecurity and Infrastructure Security Agency makes the same point in its guidance. It recommendsstrong multifactor authentication andongoing employee training to spot vishing.
2. Recovery takes longer than most plans assume
Hasbro had money, staff, and specialists. It still ran parts of the business by hand for weeks. For alaw office or a medical practice, the real question is simple. What would you do on Monday morning if your main systems were offline?
3. In Massachusetts, reporting starts at one person affected
This is the detail that caught my eye. Hasbro did not file this notice in Rhode Island, where it is still headquartered. Rhode Island only requires notice to its attorney general when more than 500 residents are affected.Massachusetts requires notice to the Attorney General and the Office of Consumer Affairs and Business Regulation no matter how many residents are affected. One client file is enough.
The state also publishes an annual data breach report, broken out by company. For an accounting firm, a law practice, or a medical office, that is atrust issue as much as a technical one. Your attorney is the right person to walk you throughyour specific obligations. My job is to help make sure you never need that conversation.
What This Means for Your Firm
I am not sharing this story to scare anyone. Most of the owners and partners I talk with are already careful. The point is that careful people can be fooled by a good caller, and a small firm feels a month of disruption more than a large company does.
My team atCMIT Solutions of Boston, Newton & Walthamhelps Greater Boston firms with24/7 monitoring, including nights, weekends, and holidays, and with theplanning that makes recovery faster when something does go wrong. I amlocally owned in Newton, and my team is backed by CMIT’s national network of more than 900 professionals across 250+ North American offices.
If you want to know where your firm stands, start with a free IT self-assessment. Or call me at (617) 221-4100 for a
On March 28, Hasbro found an intruder in its network. In a notice filed with Massachusetts regulators in late August, the company said the attack came from a “vishing and social engineering campaign.” Recovery took about three months.
2. What is vishing?+
Vishing is voice phishing. Instead of a suspicious email, someone calls seeking company information. The caller may sound like a coworker, a vendor, or the IT help desk, and asks for a password, a login code, or a quick reset.
3. How is vishing different from regular phishing?+
Regular phishing usually arrives as an email or text message with a suspicious link or attachment. Vishing happens over the phone, so firewalls and email filters never see it. It works by persuading a person, not by breaking into a system.
4. How did the attackers get in at Hasbro?+
According to Hasbro’s filing, the attack came from a vishing and social engineering campaign. Someone with their guard down was talked into opening the door. About a week after the first breach, a separate attacker used gathered information to get into an employee account.
5. What information was exposed in the Hasbro breach?+
Social Security numbers, financial account numbers, card numbers, and driver’s license information for 436 Massachusetts residents were exposed.
6. How long did it take Hasbro to recover?+
Normal order processing, shipping, and invoicing did not return until June 28, about three months after the attack. During that time, Hasbro took its primary data center offline until it could be completely rebuilt and processed orders by hand at a reduced rate.
7. How much did the Hasbro cyberattack cost?+
Hasbro has reported nearly $11 million in direct costs and about $25 million in lost revenue. A class action lawsuit was also filed in federal court in April.
8. Why does a Hasbro breach matter to a small business?+
Hasbro has a large technology team, outside advisors, and a response plan, and it still needed months to recover. A small firm has fewer resources, so it feels a month of disruption more than a large company does. A breach that starts with a single phone call is a vulnerability every size of business shares.
9. What should an employee do if someone calls asking for a password?+
Hang up and call back on a number you already know. This applies to requests for a password, a login code, a reset, or a change to payment details. A real colleague or vendor will not mind.
10. Should our help desk reset passwords over the phone?+
No. Whether your IT support is in house or outside, nobody should reset a password or a multifactor login based on a phone call alone. The help desk is one of the most common voices a vishing caller pretends to be.
11. Can multifactor authentication stop vishing?+
It helps, but only if the process around it is protected. If someone can be talked into reading out a login code or resetting a multifactor login, the protection is weakened. The Cybersecurity and Infrastructure Security Agency recommends strong multifactor authentication together with ongoing employee training to spot vishing.
12. Do firewalls and email filters protect against vishing?+
They matter, but they do not answer the phone. Vishing targets people, so employee habits and verification procedures are the main defense.
13. How often should employees be trained to spot social engineering?+
Training should be ongoing rather than a one-time event. That is the approach CISA recommends in its guidance on vishing.
14. What would we do if our main systems went offline on a Monday morning?+
That is the question every firm should answer before it happens. Work out where your backups are, who you call first, and how you would bill, schedule, or reach clients for a week without your main system.
15. How do we know our backups will actually work?+
Test them. Ask when someone last tested a restore. A backup that has never been restored is an assumption, not a recovery plan.
16. Do I have to report a data breach in Massachusetts if only one person is affected?+
Massachusetts requires notice to the Attorney General and the Office of Consumer Affairs and Business Regulation no matter how many residents are affected. One client file is enough. Your attorney can walk you through your specific obligations.
17. Why did Hasbro file its notice in Massachusetts and not Rhode Island?+
Rhode Island only requires notice to its attorney general when more than 500 residents are affected. Massachusetts has no minimum, so the 436 affected Massachusetts residents triggered a filing there.
18. Are Massachusetts data breach reports public?+
Yes. The state publishes an annual data breach report, broken out by company. For an accounting firm, a law practice, or a medical office, that makes a breach a trust issue as much as a technical one.
19. What kinds of firms are most at risk from a phone-based attack?+
Any firm that handles sensitive client information can be a target, including accounting firms, law offices, and medical practices. Careful people can still be fooled by a good caller, which is why the verification habits matter at every size.
20. How can CMIT Solutions of Boston, Newton & Waltham help my firm?+
The team provides 24/7 monitoring, including nights, weekends, and holidays, along with planning that makes recovery faster when something goes wrong. To see where your firm stands, start with the free IT self-assessment or call (617) 221-4100 for a straightforward, no obligation conversation.
