Crunchyroll confirms data breach after hacker claims unauthorized access

Crunchyroll has officially acknowledged a data breach that has affected customer service ticket information, a situation that arose due to a vulnerability linked to a third-party vendor. This revelation follows alarming claims from a hacker who asserts they accessed user data and internal systems of the popular anime streaming service. Acquired by Sony from AT&T in 2020 for an impressive $1.18 billion, Crunchyroll operates as a collaboration between Sony Pictures Entertainment in the United States and Japan's Aniplex. With a vast library of over 2,000 titles available in more than 12 languages, the platform boasts a subscriber base of around 15 million worldwide. The breach came to light when reports emerged on social media, with the hacker alleging they had obtained sensitive information about millions of users. In response, Crunchyroll stated that it is actively investigating these claims. "Our investigation is ongoing, and we are collaborating with top cybersecurity experts," the company noted in a statement to TechCrunch. They emphasized that there is currently no evidence of continued unauthorized access. Additionally, insights shared by the cybersecurity account International Cyber Digest suggest that the attacker may have exploited Crunchyroll's Zendesk support system. Screenshots purportedly revealing internal Slack conversations and compromised support data have surfaced, indicating that the breach may have originated from a compromised employee account at Telus Digital, the outsourcing firm responsible for Crunchyroll's customer support. Reports indicate that the hacker had access to customer support ticket data up until early 2025 before their access was terminated. The account also clarified that this incident is distinct from a recent breach involving Telus Digital, which the company confirmed last week. Crunchyroll has not clarified whether the third-party vendor implicated is indeed Telus Digital, and attempts to reach out to Telus Digital for comments have gone unanswered. The hacker communicated with BleepingComputer, claiming to have downloaded around eight million support ticket records from Crunchyroll, which includes approximately 6.8 million unique email addresses. However, these assertions remain unverified. The hacker reported gaining access on March 12 by compromising an Okta single sign-on account belonging to a Crunchyroll support agent.