This Week in Cybersecurity: The Hasbro Breach, ChatGPT Ad Tracking, and the 67% Nation-State Hack
The company that makes Monopoly just lost the game.
Hasbro—the toy giant behind Transformers, Nerf, Dungeons & Dragons, Play-Doh, and Peppa Pig—just disclosed that hackers stole employee Social Security numbers, bank account details, credit card numbers, and driver’s license information.
The breach occurred in late September. Hasbro detected it in November. They didn’t notify victims until February. That is a five-month window where hackers had unrestricted access to stolen financial identities before anyone was told.
And here’s the detail that matters most: The attackers got in through one compromised employee account. One. And Hasbro’s official response? “We have no indication the information will be misused,” followed by the standard offer of free credit monitoring.
If one of your employee’s credentials got stolen tonight—through a phishing email, a reused password, or an infostealer on a personal device—how far could an attacker get inside your systems before anyone noticed?
You asked ChatGPT for help picking a mattress.
Now there’s an ad for a mattress company sitting right next to the answer.
That’s not a hypothetical. That is how ChatGPT officially works now.
Ask about a vacation? Get a hotel ad. Ask about back pain? Get a supplement ad. Ask about business restructuring or marital trouble? Well, let’s hope they draw a line somewhere.
OpenAI states conversations stay private, ads don’t influence model weights, and advertisers only get aggregated impressions and clicks. Maybe that’s true today. But here’s what nobody is talking about:
“People don’t talk to ChatGPT the way they talk to Google. You don’t type three keywords. You tell it your problems. Your fears. Your strategic business challenges. Things you wouldn’t say out loud to a coworker.”
The free version of anything is never free. You pay with something. In this case, you are paying with the most intimate window into your organization’s intellectual property that any tech company has ever possessed.
Two-thirds of an entire country just got breached.
Latvia’s Road Traffic Safety Directorate—the government agency that oversees vehicle registration, driver’s licenses, and road safety—confirmed that threat actors stole personal records on more than 1.2 million citizens.
If you live in Latvia, there is a two-in-three chance your personal identity was in that breach. Eighteen years of historical records dating back to 2008:
The attackers got in through an unpatched vulnerability in an internet-facing system. One exposed entry point. That is all it took to compromise two-thirds of a sovereign nation.
The agency was late to report it. They publicly described it as a “complex cyberattack”—which is what organizations say when they don’t want to admit it was completely preventable with routine external vulnerability scanning.
Senior government officials have been called to resign. Public trust in the agency is shattered.
“Do you know what’s connected to the internet on your corporate network right now? Not what you think is connected. What actually is.”
Because there is almost always something that was forgotten: a staging server from three years ago, a retired portal nobody monitors, an old IP camera forwarded through the firewall, or a vendor API key left active.
Latvia didn’t know either.
Authored by our certified engineers, security architects, and leadership team. Want to implement these solutions in your organization?
