Weekly Cyber Roundup Covers Hasbro, Supply-Chain Attacks and Breaches
Summary
The roundup covers Hasbro’s reported unauthorized access, Mercor’s LiteLLM supply-chain breach, a Lazarus-attributed Axios attack, an email breach attributed to Iran-linked Handala, and a CareCloud EHR intrusion.
Key points
- Hasbro detected unauthorized network access on March 28, 2026, isolated affected systems and engaged external experts; core operations continued under contingency plans, though delays were expected.
- Mercor confirmed a breach linked to a malicious LiteLLM package update that the article says affected thousands of organizations. TeamPCP was associated with the incident, while Lapsus$ claimed involvement.
- The article attributes a malicious dependency inserted into the Axios JavaScript library to Lazarus Group; it says automated installations enabled backdoor access across multiple operating systems.
- The article says hackers linked to Iran compromised and leaked personal emails and data from FBI Director Kash Patel, attributing the operation to the Handala Hack Team.
- CareCloud disclosed unauthorized access to its electronic health record system, detected March 16 and contained after about eight hours; investigation into possible patient-data exposure was ongoing.
- The roundup recommends stronger supply-chain oversight, robust access controls and rapid incident response.
Article Details
- Event Type
- Weekly roundup of cyber incidents, including supply-chain compromises, corporate and healthcare breaches, a hack-and-leak operation, and a cybercrime case.
- Impact
- Hasbro reported unauthorized network access and expected some operational delays despite contingency measures. Mercor confirmed a breach linked to a malicious LiteLLM package update that reportedly affected thousands of organizations. A malicious dependency inserted into Axios was attributed to Lazarus Group and enabled backdoor access. Emails and personal data were leaked after FBI Director Kash Patel’s personal email was compromised. CareCloud reported an intrusion into its electronic health record system, with potential exposure of sensitive patient data.
MITRE ATT&CK
People
Threat Actors
764The article describes an extremist network linked to a U.S. individual’s guilty plea on charges related to child exploitation and cyberstalking.Handala Hack TeamWas attributed the hack-and-leak operation involving the compromise of Kash Patel’s personal email.LAPSUS$Claimed involvement in the Mercor breach; the article does not confirm that claim.Lazarus GroupWas attributed responsibility for inserting a malicious dependency into the Axios JavaScript library.TeamPCPWas associated with the supply-chain compromise linked to a malicious LiteLLM package update.
Products
Axiosand the Mercor/LiteLLM supply-chain compromise linked to TeamPCP and Lapsus$, to Lazarus Group’s Axios library attack, the FBI director’s email leak, and the CareCloud health-records breach.LiteLLMroundup summarizes a wave of high-impact incidents—from the Hasbro operational disruption and the Mercor/LiteLLM supply-chain compromise linked to TeamPCP and Lapsus$, to Lazarus Group’s Axios library attack, the FBI
Countries
IranHackers linked to Iran and the Handala Hack Team compromised FBI Director Kash Patel’s personal email in a hack-and-leak operation.North KoreaThe operation has been attributed to North Korea’s Lazarus Group, known for conducting advanced cyber campaigns.United StatesIn a separate case, a U.S. individual pleaded guilty to charges related to child exploitation and cyberstalking linked to the extremist “764” network.