Week in Review
Hasbro hacked. Russian routers hijacked. FBI records $21 billion in losses. A WordPress plugin update turned into malware. One week, six incidents — here's what they all mean for your business.
247Techify Editorial
April 11, 2026
8 min read
This was one of the busiest weeks in cybersecurity news in recent memory. Six major incidents — each different in method, each targeting a different part of how businesses operate — dropped in a single seven-day window. If you've been too busy running your business to keep up, this is your Saturday catch-up.
Every story below is directly relevant to small and medium businesses across Ontario. Not as abstract warnings — but as specific, practical reminders of what attackers are doing right now, and what you can do about it.
Story 01
Hasbro Got Hacked — And Recovery Is Taking Weeks
The company behind Monopoly, Transformers, Nerf, and Play-Doh confirmed a cyberattack that knocked systems offline and disrupted order processing and shipping across the business. In a filing with the U.S. Securities and Exchange Commission, Hasbro warned it could take "several weeks" before the situation is fully resolved.
Hasbro has $4.7 billion in annual revenue, over 5,000 employees, and dedicated cybersecurity protocols already in place. They still got hit. The only reason their business kept running was their business continuity plans.
The takeaway for Ontario businesses:
If a $4.7B company with a full IT team gets breached, so can you. The question is whether your business would survive weeks of disruption — and whether you have a continuity plan ready to activate.
Story 02
IBM's 2026 Threat Report: 56% of Vulnerabilities Need Zero Authentication
IBM's X-Force Threat Intelligence Index 2026 revealed that more than half of the vulnerabilities tracked last year could be exploited without any authentication — no stolen password, no phishing, no MFA bypass required. Attackers simply find an unpatched or misconfigured system and walk straight in.
The report also found vulnerability exploitation overtook phishing as the #1 cause of attacks (40% of all incidents), ransomware groups surged 49%, and supply chain compromises quadrupled since 2020.
The takeaway for Ontario businesses:
Most breaches don't require sophisticated attacks — they exploit basics that businesses let slide. Unpatched software and misconfigured systems are the open doors. Keeping these closed is the most important thing your IT team can do.
Story 03
Russian Hackers Hijacked 18,000 Small Office Routers Worldwide
An international law enforcement operation dismantled FrostArmada — a campaign by Russian state-linked group APT28 that compromised MikroTik and TP-Link routers in small offices worldwide. The attack required no malware. By changing a single DNS setting, every login to Microsoft 365 and Outlook was silently intercepted and credentials stolen.
At its peak the campaign infected 18,000 devices across 120 countries. The only warning sign was an SSL certificate error most users would click straight through.
The takeaway for Ontario businesses:
Your office router is not a set-and-forget device. It needs firmware updates, proper configuration, and monitoring — just like your computers and software. When did yours last get a security check?
Story 04
Device Code Phishing Surged 37x — And Bypasses MFA Entirely
A new category of phishing attack surged 37 times in 2026. Device code phishing tricks employees into entering a code on a real Microsoft login page — which silently grants attackers full access to the account. No fake links. No suspicious attachments. Your employee completes their normal MFA challenge. The attacker receives the access token anyway.
Microsoft's own security blog published an emergency advisory this week, confirming a widespread campaign using AI-generated lures. Over 340 organisations were confirmed hit in recent months.
The takeaway for Ontario businesses:
Your team needs to know that any email asking them to enter a code at microsoft.com/devicelogin should trigger an immediate pause and a call to IT. This specific scenario — and why MFA doesn't stop it — needs to be part of your next staff briefing.
Story 05
FBI: $21 Billion Lost to Cybercrime in 2025 — Up 26%
The FBI's 2025 Internet Crime Report landed this week with record numbers. $21 billion in losses — up 26% from 2024. Over one million complaints filed, averaging nearly 3,000 per day. Business Email Compromise was the second largest source of losses at $3 billion, with attackers impersonating vendors, executives, and suppliers to trick businesses into fraudulent payments.
For the first time in its 25-year history, the report added a dedicated section on AI-enabled fraud — already $893 million in losses in year one of tracking.
The takeaway for Ontario businesses:
BEC attacks are the most low-tech, high-impact threat on the list. One convincing email, one wire transfer, gone. A simple policy — verify any payment change by phone call to a number you already have — stops the majority of these attacks cold.
Story 06
WordPress Plugin Update Delivered Malware to 800,000 Sites
Hackers broke into the update infrastructure for Smart Slider 3 Pro — a plugin installed on over 800,000 WordPress websites — and pushed a malicious version through the official channel. Any site that clicked "Update Plugin" between release and detection received a fully weaponised remote access toolkit: hidden admin accounts, credential theft, backdoors in multiple locations, and persistent access that survives plugin removal.
This is a textbook supply chain attack — and the reason IBM found supply chain compromises have nearly quadrupled since 2020.
The takeaway for Ontario businesses:
If your business runs a website — especially WordPress — someone needs to be monitoring it, not just updating it. Backups, security scanning, and someone watching for exactly these incidents are no longer optional.
What all six stories have in common
Look across these six incidents and a pattern emerges. None of them required a genius hacker or nation-state resources to succeed. They exploited: unpatched routers. Trusted update channels. Employees who didn't know what to watch for. Businesses without monitoring in place. Wire transfers made without a phone call to verify.
The most common thread in every major cybersecurity incident of 2026 — from the IBM X-Force report to the FBI's annual findings — is not sophisticated technology. It's the absence of basic, consistent maintenance. The businesses that got hit weren't necessarily negligent. They were busy. And the basics quietly slipped.
"In 2026, the biggest threat isn't any one attack. It's distraction — chasing the threat of the month while losing sight of the fundamentals that actually determine resilience." — Cybersecurity Tribe, April 2026
Your quick weekend checklist
Six things you can check before Monday morning — each one directly addresses a story from this week:
🎲
Do you have a business continuity plan?
Could your business keep operating if systems went down for two weeks? If not — Hasbro is your warning.
🔧
When were your systems and software last patched?
IBM found 56% of exploitable vulnerabilities need no credentials. Patching closes the door before attackers find it.
📡
When was your office router last updated?
FrostArmada targeted unpatched SOHO routers specifically. Log in and check your firmware version today.
📧
Does your team know about device code phishing?
Forward our Tuesday blog post to your team. This is a specific new attack that bypasses MFA — most people have never heard of it.
💸
Is there a verify-by-phone rule for payment changes?
$3 billion was stolen through BEC in 2025. One standing rule — call to verify any bank or payment change before acting — stops most of these attacks.
🌐
Who is monitoring your website?
If your business has a WordPress site, check your Smart Slider 3 Pro version (update to 3.5.1.36 if needed) and confirm someone is watching for security advisories on your behalf.
The bottom line
One week. Six major incidents. Every one of them relevant to small businesses in Ontario. That's not unusual for 2026 — this is the pace of the threat landscape now.
The businesses that survive this environment are not necessarily the ones with the biggest budgets. They're the ones that do the basics consistently — patching, monitoring, training, verification habits, backups — and have an IT partner who is watching their environment so they don't have to do it alone.
At 247Techify we track these threats weekly and make sure our Ontario clients are protected before incidents like these become headlines for them. If you'd like to know where your business stands, start with a free conversation.
Week in Review
Cybersecurity
Managed IT
Hasbro Hack
IBM X-Force 2026
Router Security
Ontario Business
247Techify
Want someone watching your IT environment full time?
247Techify protects Ontario businesses 24/7 — free consultation, no pressure.
Book a free review ↗
