Subject: Re: Inquiry regarding production employee data leak (PRIVILEGED & CONFIDENTIAL)
From: "Steele, Paula" <[email-masked]>
To: "Sibley, Tarrant" <[email-masked]>, "Kim, Julia" <[email-masked]>, "LaPorte, Jaime" <[email-masked]>
Date: Thu, 21 Dec 2017 18:35:47 -0500

Hi Tarrant, Julia,

That response makes sense to me. I haven't been involved in this issue but can touch base with Jaime and Ed if you need anything further from the employment side of things.

Thanks for coordinating the response,

Paula

Sent from my iPhone

On Dec 21, 2017, at 6:29 PM, Sibley, Tarrant <[email-masked]> wrote:

Thank you everyone.  I am sure the IT team is already doing this, but it seems like this is a more targeted and concerted effort against Hasbro, given the number of things that are happening in a short time frame,
and should be treated as such.

Julia, what I suggest is that you call (don’t email) Paul tomorrow and tell him we are aware of a leak of certain MLP assets and are aggressively investigating it. But we do not have any reason to believe at
this time that any personal information of his client was involved in any way.

Are folks OK with that?

Best,

Tarrant

From: Melanson, Steve

Sent: Thursday, December 21, 2017 5:55 PM

To: McGowan, Brian; Kim, Julia

Cc: Boulanger, Caroline; Sibley, Tarrant; Gianetti, Ed; LaPorte, Jaime; Langston, Elizabeth; Steele, Paula; Swayze, Melissa; Fantini, Rob; Matlach, Nicholas; Ellis, Joshua

Subject: Re: Inquiry regarding production employee data leak (PRIVILEGED & CONFIDENTIAL)

Hi Everyone,

Not sure if you have enough for a response yet but we'll take the Legal team's lead on whether you want to respond based on what info we have now as
an "interim" response or wait until we have more info.

We're around tomorrow if you want to set up a call to discuss.

I also agree we need to discuss how these are orchestrated moving forward.

Regards,

Steve Melanson

VP Global IT Operations

From: Kim, Julia

Sent: Thursday, December 21, 2017 5:37:50 PM

To: McGowan, Brian

Cc: Boulanger, Caroline; Sibley, Tarrant; Gianetti, Ed; LaPorte, Jaime; Langston, Elizabeth; Steele, Paula; Swayze, Melissa; Fantini, Rob; Matlach, Nicholas; Melanson, Steve; Ellis, Joshua

Subject: Re: Inquiry regarding production employee data leak (PRIVILEGED & CONFIDENTIAL)

Hi Brian,

The inquiry came from one of our writers, Josh Haber. His rep is inquiring the extent of the leak, but he did not cite any specific example of Josh’s PI being compromised. So unfortunately we don’t have specific
terms for you to search besides his name.

Sent from my iPhone

On Dec 21, 2017, at 2:07 PM, McGowan, Brian <[email-masked]> wrote:

+ Steve M and Josh Ellis

Tarrant, Caroline,

We’re unaware of any PI leaks as a result of the MLP incident. The IT security team is currently looking in to unauthorized access to potentially 3 (likely 2) employees’ email accounts to determine how those accounts were accessed.  We
believe the MLP movie leak sourced from a partner’s FTP site (DHX).  We’re unaware of any other unauthorized access to Hasbro or Hasbro’s partner’s systems at this time.  Based on the known unauthorized access we’re unaware of how the individual’s PI would
have been exposed unless it was contained in emails sent to or from the 3 employees who may have suffered unauthorized access to their email or OneDrive accounts.  Please note the access was to O365 and not any systems internal to Hasbro’s network.

If someone can provide specific terms suspected of being leaked, meaning the individual’s personal information, for us to search, we can work to determine if it was included in any of the emails that were accessed.

Finally, I agree with the need to examine roles and responsibilities.  I agree with your assessment - this incident expanded beyond a typical IP leak and warranted a different response from the collective team.

Brian

From: Boulanger, Caroline

Sent: Thursday, December 21, 2017 4:31 PM

To: Sibley, Tarrant <[email-masked]>; Gianetti, Ed <[email-masked]>; Kim, Julia <[email-masked]>;
LaPorte, Jaime <[email-masked]>; Langston, Elizabeth <[email-masked]>; Steele, Paula <[email-masked]>;
McGowan, Brian <[email-masked]>

Cc: Swayze, Melissa <[email-masked]>; Fantini, Rob <[email-masked]>; Matlach, Nicholas <[email-masked]>

Subject: RE: Inquiry regarding production employee data leak (PRIVILEGED & CONFIDENTIAL)

Hi Everyone,

Just to jump in from the privacy side, data breach laws vary by state, but a legal obligation to disclose/notify would typically attach if there is an unauthorized disclosure or acquisition of an individual’s
personal information. To better assess, we would want to know:

What information was involved? Does it involve this individual only or others?

Note: As Tarrant points out, we’re really concerned with whether Personal Information is involved. As laws differ on a state-by-state basis, though, it will help to have a laundry list
of the information first.

What is the individual’s state of residence?

Note: This bit of information will drive the analysis because the laws are triggered by state of residency and differ among states.

Was the information acquired by, or reasonably believed to be acquired by, an unauthorized person?

Was this information encrypted or unencrypted?

Have any risk mitigation measures been put in place? If so, what and when?

Thanks very much - I agree with Tarrant’s broader point about meeting in the New Year to discuss roles and responsibilities regarding leaks and whether this should continue to be part of the CSIRP or whether
a separate procedure for leak investigations should be created. Thanks again!

Best,

Caroline

From: Sibley, Tarrant

Sent: Thursday, December 21, 2017 3:07 PM

To: Gianetti, Ed; Kim, Julia; LaPorte, Jaime; Boulanger, Caroline; Langston, Elizabeth; Steele, Paula; McGowan, Brian

Cc: Swayze, Melissa; Fantini, Rob; Matlach, Nicholas

Subject: RE: Inquiry regarding production employee data leak

Brian, do you know of any personal information being leaked?

From: Gianetti, Ed

Sent: Thursday, December 21, 2017 3:03 PM

To: Sibley, Tarrant; Kim, Julia; LaPorte, Jaime; Boulanger, Caroline; Langston, Elizabeth; Steele, Paula

Cc: Swayze, Melissa; Fantini, Rob; Matlach, Nicholas

Subject: RE: Inquiry regarding production employee data leak

Hi Julia,

I am not aware of any personal information being leaked except Meghan and my Hasbro emails, along with the MLP content. But we do not know the extent of this hack as of yet. IT (Brian McGowan) is currently investigating that aspect. As
far responding to Josh’s rep. that would be a Legal question.

Ed

From: Sibley, Tarrant

Sent: Thursday, December 21, 2017 2:58 PM

To: Kim, Julia <[email-masked]>; Gianetti, Ed <[email-masked]>; LaPorte, Jaime <[email-masked]>;
Boulanger, Caroline <[email-masked]>; Langston, Elizabeth <[email-masked]>; Steele, Paula <[email-masked]>

Cc: Swayze, Melissa <[email-masked]>

Subject: RE: Inquiry regarding production employee data leak

HI Julia:

There are two questions here from my perspective. First, what do we know (or think) was leaked. And then second, what do we say in response to an inquiry like this.

On the first point, I am aware of some MLP concept art having been leaked, as well as Meghan’s email having been hacked. But do we think anyone’s personal information (other than maybe Meghan) has gotten out?
This inquiry is saying personal information about Josh Haber, the writer, has been compromised. I haven’t heard anything about that. Do we think that is true (that is a question to the entire group)?

Then the answer to that question informs how I think we should respond.  If we don’t think any personal information has been leaked I would respond to the effect that it appears some concept art for MLP was leaked,
and we are investigating that, but we are not aware of any leak of personal information related to Josh.  But I would only say that if that is true.  Do others have different information or views?

I do think when everyone returns from the break, given the leaks we are having, we need a group discussion on exactly how we are pursuing the leaks and who internally is running point on different aspects of
leaks.

Best,

Tarrant

From: Kim, Julia

Sent: Thursday, December 21, 2017 2:48 PM

To: Gianetti, Ed

Cc: Sibley, Tarrant; Swayze, Melissa

Subject: FW: Inquiry regarding production employee data leak

Hi Ed:

We received the below inquiry from one of our writer’s rep. Can you please advise how I should/can respond? Unless there’s any objection, I’m inclined to respond (because I’ll need to at some point soon to get this deal signed) that our
investigation is still on-going and that we will advise when we’re able and ready.

Tarrant—let me know if I should be looping in Paula/Jaime as well to get their insight from an employment perspective.

Best,

Julia

Tel: 818-478-4416

Cell: 818-237-6491

CONFIDENTIAL

This communication and any attachments may contain information that is privileged or confidential and is intended only for the use of the individual to whom it is addressed. Any other
distribution, copying or disclosure is strictly prohibited. If you have received this communication in error, please notify me immediately and then delete this communication. Thank you.

From: PAUL MILOKNAY [mailto:[email-masked]]

Sent: Thursday, December 21, 2017 11:23 AM

To: Kim, Julia <[email-masked]>

Cc: Krauseneck, Martha <[email-masked]>; Lujano, Lupe <[email-masked]>; Swayze, Melissa <[email-masked]>;
Sibley, Tarrant <[email-masked]>; Matt Schichtman <[email-masked]>

Subject: Re: Josh Haber / My Little Pony Specials / Story Summits

Dear Julie,

Our offices are closed, but I’ll review this as soon as I can.  In the meantime, it has come to my attention that Hasbro suffered a data breach recently and that confidential information about MLP and my client were compromised.  Please
advise as to the extent of the breach and what measures are being taken to protect Josh’s personal information.  If there’s somebody else I should talk to about this situation, please advise.

Thanks,

Paul

Paul M. Miloknay, Esq.

MiloknayWeiner LLP

5455 Wilshire Blvd., Suite 1114

Los Angeles, CA 90036

P:  323.935.3400

F:  323.932.9726

[email-masked]

This message, along with any attachments, is intended only for the use of the individual or entity to which it is addressed and may contain information that is legally privileged,
confidential or exempt from disclosure.  If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this message, or any attachment, is strictly prohibited.  If you have received this message in error,
please notify the original sender or MiloknayWeiner LLP immediately by telephone or E-mail and delete this message, along with any attachments, from your computer.  Thank you.

On Dec 20, 2017, at 2:58 PM, Kim, Julia <[email-masked]> wrote:

Hi Paul:

Attached please find the agreement in connection with Josh Haber’s writing and consulting services and story summit participation for the upcoming standalone TV specials for the brand “My Little Pony”. Please note that the attached has
been drafted based on the latest agreement we negotiated with you for Josh. As our story summit is currently scheduled to occur on January 2, we’d very much appreciate your help in finalizing this before the end of year. As I am simultaneously circulating
this agreement to the appropriate executives I must reserve the right to make any changes based on their comments. If this agreement, as drafted, is acceptable, please arrange for signature and return a scanned copy to my attention. Thereafter, I will arrange
for full execution and return a countersigned copy for your files.

Best,

Julia Kim

Attorney, Business & Legal Affairs

Hasbro Studios

3333 W. Empire Ave., 5th Fl.

Burbank, CA 91504

Tel: 818-478-4416

Cell: 818-237-6491

CONFIDENTIAL

This communication and any attachments may contain information that is privileged or confidential and is intended only for the use of the individual to whom it is addressed. Any other
distribution, copying or disclosure is strictly prohibited. If you have received this communication in error, please notify me immediately and then delete this communication. Thank you.

<Josh Haber_MLP 60min Specials_Story Summits_12.20.17.pdf>