Crunchyroll Supply Chain Breach: 100GB of Subscriber Data Allegedly Leaked via BPO Partner
Learn More
Crunchyroll, the Sony-owned anime streaming giant, reports a data breach on March 12, 2026. The incident was caused by a supply chain compromise at third-party BPO provider TELUS Digital.
The breach occurred when an employee at TELUS executed malware on their workstation, allowing a attacker to gain a foothold in the third-party BPO provider's network, gaining access to their ticketing system and customer analytics platforms. The attacker had access around 24 hours before Crunchyroll revoked the credentials and blocked their access to the platform.
The compromised data includes:
- Credit card details
- Email addresses
- IP addresses
- Customer analytics data (PII)
- Support tickets and subscriber issues
The threat actor claims to have stolen approximately 100 GB of data. The number of affected individuals is not disclosed, and the company has not provided an estimate for financial damages or ransom demands.
The company is reportedly notifying impacted customers as the investigation continues. As of publication time, Crunchyroll has not issued a public disclosure or mandated password resets for its subscribers.
Security specialists recommend users change their passwords, monitor financial statements for fraudulent charges, and be wary of phishing attempts using stolen metadata.
Update - Crunchyroll is investigating a claimed March 12 data breach in which a hacker allegedly used malware to compromise a support agent's Okta credentials, gaining access to multiple third-party services and exfiltrating roughly 8 million Zendesk support tickets containing email addresses, IP addresses, and credit card details (only if the user shared card detalis in the support ticket)
In the exposed records there are allegedly 6.8 million unique email addresses. Samples of the tickets seen by BleepingComputer contain Crunchyroll user's name, login name, email address, IP address, general geographic location, and the contents of the support tickets. The breach reportedly originated through outsourcing partner Telus, and access was revoked after 24 hours.
