Hasbro got hit earlier this year. Operations stumbled. Factories and fulfillment are the parts you can see from the parking lot. This week the company is telling employees their personal information was in the blast radius. That delay is the standard clock. Most cybersecurity programs still treat the incident as over when systems come back, the war room closes, and the HR file shows up in a disclosure months later.

You’re going to see more letters like that. Not because attackers got louder. Because the path out of your network got quieter, and the systems that actually hold people data still sit outside the stack your SOC loves to tune.

The outage is the part your board already knows

Boards understand downtime. A toy and game giant missing orders is a story with a start, a middle, and a press statement. Employee personal information is a slower story. It lives in HRIS exports, badge photos, home addresses, tax forms, and the shared drives somebody mapped in 2019 because payroll needed a workaround. When Hasbro says a cyberattack caused disruptions earlier this year and is only now disclosing a data breach, you should hear the operational sequence, not a mystery.

Containment restored the factory. Forensics on identity stores lagged. Legal waited for a complete inventory. None of that is exotic. It’s what happens when incident response is staffed and rehearsed for “get shipping working” and improvised for “what left with them.”

If you run cyber security for a company that makes physical things, you already know the gravity well. Plant networks, warehouse Wi-Fi, and vendor portals get the budget after something breaks. The HR tenant, the badge vendor, and the file share named “Employee_Files_FINAL2” get a policy PDF. Attackers read that org chart better than your last tabletop did.

The letter is the lagging indicator. The leading indicator showed up in your egress logs, your CMS, and a helpdesk ticket that looked like a user being helpful.

Reverse tunnels don’t set off the pretty dashboards

Microsoft Threat Intelligence just walked through TerminalFix, a ClickFix-style campaign that does not smash the front door and wait for applause. Fake CAPTCHA page. User pastes a “verification” command. DLL sideloading off a trusted binary. Then a reverse tunnel. That last stage is the one your firewall is least interested in, because the packet is leaving.

Inbound brute-force still lights up every dashboard you bought. Outbound connections that look like a browser session, a support tool, or a cloudy admin channel do not. Threat detection that is still organized around “bad IPs hitting us” will file TerminalFix under noise, if it files it at all. The operator on the other end of that tunnel is not in a hurry. They have a foothold that survives your reboot, your password reset, and the Friday all-clear.

DLL sideloading is old. You should be tired of it. Defenders still allow signed binaries from everyday software to load libraries from writable directories because “that’s how the vendor shipped it.” Pair that with a user who thought they were proving they weren’t a robot, and you get a beachhead that never needed to beat your threat-protection stack in a fair fight.

Hunt the tunnel, not the meme. New services listening locally. Unusual child processes off signed apps. Persistent outbound sessions to hosts your users have no business chatting with. If your only picture of “C2” is a malware hash on a denylist, TerminalFix is already inside the room, holding the door.

If your cybersecurity program still calls WordPress “the blog”

Same week, five critical bugs landed in WordPress plugins and themes you have probably been asked to “just whitelist” for marketing. WPMU DEV Dashboard, Avada, TranslatePress, Pods, GiveWP. Wordfence and Patchstack scored them in the takeover-and-RCE bucket. One of them, CVE-2026-76581, sits at 9.8: authentication bypass. The rest of the set buys account takeover and arbitrary code execution. That is a shell on the box that serves your public site, your donation flow, and whatever plugin copied production data into wp-content because a form needed a CSV.

GiveWP processes money. Avada is the theme half the internet’s brochureware still runs. Pods lets people invent custom content types until a developer from 2022 is the only person who remembers why. None of this is a side project. It’s production with a nicer skin, usually patched by whoever has FTP and a free afternoon.

Security hardening for WordPress still gets treated like a checklist from 2014: hide wp-login, hope the host has a WAF, call it defense in depth. A WAF in front of an unpatched admin plugin is a speed bump. Logic bugs do not look like password spraying. Your brute-force alerts will stay green while someone walks in through a dashboard that never asked for a second factor.

Connect that to Hasbro’s letter and TerminalFix’s tunnel and the shape is obvious. Loud recovery. Quiet access. A content stack nobody inventoried. Then a disclosure about people, not packets.

Recovery is not the same thing as containment

You do not need a new platform for this. You need a finish line that is later than “the plant is up.” Treat the Hasbro timeline as a drill you can run without waiting for your own lawyers to write the email.

• Today: Export every WordPress plugin, theme, and must-use drop-in across every public property, including the “temporary” campaign microsite. Compare versions to current advisories. If a plugin has no owner in your CMDB, it has an owner now: you. Pull admin user lists and disable anything that is not a named human on a current ticket.
• This week: Hunt outbound tunnels the way you’d hunt a VPN you didn’t buy. Baseline which workstations and servers make long-lived outbound connections. Alert on signed binaries spawning unusual children, especially from user-writable paths. Walk your firewall allow-lists for “required for support” destinations that have not been reviewed since the vendor’s last acquisition.
• Before the next tabletop: Put HR, payroll, badge, and identity stores on the same crown-jewel list as the payment switch. Define what “systems restored” means versus what “exfiltration scoped” means, and do not let the first close the incident ticket. Practice collecting file-access logs and SaaS audit trails while the plant is still down, not after everyone has gone home.
• Ongoing: Patch CMS components on the same clock as internet-facing VPNs. Require MFA on every WordPress admin, including agencies. Block the ClickFix class of “paste this to continue” prompts with browser and endpoint controls that stop arbitrary command paste-off from fake CAPTCHA pages. Keep threat detection honest: inbound noise is not your only signal, and a quiet reverse tunnel is a full incident, not a hygiene finding.

Defense in depth here is boring on purpose. Identity on the CMS. Egress that you can explain. HR data that is not sitting in a share because Finance liked Excel. Incident response that keeps a second clock running after the outage ends. If your threat-protection story is still “the firewall is doing great,” TerminalFix already voted no, and Hasbro’s employees are reading the minutes.

Sources

• TerminalFix campaign deploys a reverse tunnel through multistage intrusion
• Hasbro Data Breach Exposed Employee Personal Information
• Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE