Hasbro Breach Exposes Employee Data, Rogue Chrome Extensions Steal Crypto 🔓

Two stories from this week's security news show that the threats aren't always the exotic, headline-grabbing kind — sometimes it's a breached HR database or a browser extension you installed years ago and forgot about. Here's what happened and why it matters.

Hasbro Data Breach Exposes Employee SSNs and Financial Info

Toy giant Hasbro has notified current and former employees that attackers may have accessed their names, contact details, national ID numbers, and financial information. Massachusetts alone reported 436 affected residents, suggesting the true number of victims nationwide is likely much higher. The breach appears connected to a March network incident that forced systems offline — a disruption Hasbro says has already cost it roughly $11 million in cleanup and $25 million in delayed sales.

So what? If you've ever worked for Hasbro, this is the kind of breach that fuels identity theft and tax fraud for years, not days. And for every business owner reading this: breach costs rarely stop at the initial incident — the cleanup, lost sales, and legal fallout can dwarf what a solid incident response plan would have cost upfront.

Read more

19 Chrome and Edge Extensions Caught Stealing Crypto and Browser Data

Security researchers found that attackers quietly bought up popular, already-trusted Chrome and Edge extensions and then pushed malicious updates through the normal auto-update process. Nineteen extensions were weaponized this way before being pulled from the Chrome Web Store — silently stripping security headers and hijacking cryptocurrency transactions in the background, all without users doing anything wrong.

So what? You didn't have to click a bad link or fall for a phishing email to be exposed — you just had to already trust an extension that got quietly resold to bad actors. It's a good reminder to periodically audit your installed extensions and remove anything you no longer use or recognize.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.