Hasbro breaches: Owner of Peppa Pig and Transformers cautions of potential weeks of disruptions.

      Somewhere within Hasbro's network, an individual was present where they shouldn't have been. The $14.4 billion toy and entertainment conglomerate, which owns Peppa Pig, Transformers, Monopoly, Dungeons & Dragons, Nerf, Play-Doh, and Power Rangers, announced on Wednesday that it had discovered unauthorized access to its systems. This intrusion, first identified on March 28, has compelled the company to take certain parts of its infrastructure offline and issue warnings about potential delays in product deliveries that could last for weeks.

      This announcement was made through an 8-K filing with the US Securities and Exchange Commission, the required method for publicly traded companies to report significant cybersecurity incidents. Hasbro stated that it had activated its security incident response protocols, enlisted third-party cybersecurity experts, and implemented containment measures. A representative stated to the BBC that the company has “taken swift action to protect our systems and data,” but neither the filing nor the spokesperson provided details on the nature of the attack, whether contact was made by the intruders, or if customer data had been compromised.

      On Wednesday afternoon, sections of Hasbro's own website and those of its individual brands were showing error messages. TechCrunch verified that the company’s websites appeared to be down upon inspection. The wording in the SEC filing, which mentions that Hasbro is working to “implement measures to secure its business operations,” indicates that the attackers may not have been entirely removed from the network. The company mentioned that it has established business-continuity plans to continue processing orders and shipping products but noted that these interim solutions “may continue for several weeks before the situation is fully resolved and may lead to some delays."

      Hasbro declined to respond to TechCrunch's inquiries about whether the incident was related to ransomware, the type of attack that has been prevalent in the corporate threat landscape over the past two years. The company’s spokesperson, Andrea Snyder, reiterated the language from the SEC filing without adding further details. Hasbro indicated that the investigation is ongoing, with efforts to ascertain the full extent of the breach and to examine potentially affected files before issuing any legally required notifications.

      The timing of the incident is noteworthy. Hasbro is coming off one of its strongest financial years, reporting 2025 revenue of $4.7 billion, a 14 percent increase fueled by record growth in the Wizards of the Coast and Digital Gaming segment, where Magic: The Gathering revenue grew by 23 percent due to a successful Final Fantasy crossover set. The company had projected another 3 to 5 percent revenue increase for 2026. A prolonged systems outage during a period of operational success is exactly the kind of disruption that large companies have struggled to manage effectively, especially when the recovery time remains uncertain.

      This breach occurs within a corporate landscape that has become disturbingly accustomed to such attacks. Around Easter 2025, a coordinated series of intrusions impacted several of Britain's largest retailers: Marks & Spencer faced an estimated £300 million loss after its online services were disabled for two months, the Co-op had data stolen from all 6.5 million of its members at an estimated cost of £100 million, and Harrods experienced disruptions costing approximately £30 million. Later in the year, Jaguar Land Rover was attacked, which the Cyber Monitoring Centre labeled the most financially damaging cyber event in UK history, resulting in production halting at its factories for five weeks, with the overall economic damage assessed at £1.9 billion.

      The trend extended beyond the UK. In September 2025, Japanese brewing giant Asahi suffered a ransomware attack that forced the company to revert to pen and paper, jeopardizing the personal data of around 1.9 million individuals, and causing operational disruptions extending into 2026, with the Qilin ransomware group claiming responsibility. Global ransomware attacks surged by 32 percent in 2025, as per industry data, with manufacturers emerging as the most attacked sector. However, the average cost of a data breach decreased to $4.44 million in 2025, reflecting a 9 percent decline that IBM attributed largely to organizations utilizing AI-assisted detection and automated response—a capability that varies across sectors.

      For a company like Hasbro, whose primary business revolves around physical products and entertainment licensing rather than technology, its approach to cybersecurity is inherently different from that of a software company or a financial institution. Toy manufacturers hold consumer data, manage supply-chain logistics, and protect intellectual property related to some of the most well-known brands globally, yet they are typically not equipped or funded for the kind of adversarial pressures that cybersecurity experts increasingly caution is becoming prevalent in every sector. The SEC's cybersecurity disclosure regulations, which began in late 2023, require companies to report significant incidents within four business days, ensuring that breaches like Hasbro's are brought to public attention more rapidly than before.

      What remains uncertain is whether Hasbro’s breach will mirror the pattern seen in UK retail attacks—resulting in extensive disruption, considerable financial impact, and eventual normalization