Crunchyroll Data Breach: Over 6.8M Accounts Impacted

A massive data breach at Crunchyroll has put the personal information of 6.8 million users at risk.

Hackers claim to have stolen over 100GB of sensitive records from the popular anime streaming platform owned by Sony.

The attack reportedly took place on March 12, 2026, through a compromised employee at Telus, an outsourcing partner that handles customer support for the service.

According to several sources, the hacker infected the worker’s device with malware, captured their Okta single sign-on credentials, and broke into several internal systems including Zendesk, Slack, and Google Workspace.

How the Crunchyroll Data Breach Happened

During a 24-hour window before being locked out, the attacker downloaded roughly 8 million support ticket records from Crunchyroll’s Zendesk system. Those records contained 6.8 million unique email addresses along with other personal details.

Stolen data includes:

• Names and login usernames
• Email addresses
• IP addresses and general geographic locations
• Support ticket contents
• Some credit card information (shared by customers within tickets)

It was confirmed that card numbers were only exposed when users included them in support messages. Most entries showed just the last four digits or expiration dates, though a small number did contain full card details. Emails and IP addresses were also leaked:

TROYPOINT Tip: Protect your identity and personal info from a data breach by using Aura Identity Theft Protection which is TROYPOINT’s recommended identity theft protection.

Aura Identity Theft Protection Review

Crunchyroll has not directly notified affected users about the breach. The company only acknowledged the incident after reporters from BleepingComputer reached out for comment and a spokesperson stated the following:

“We are aware of recent claims and are currently working closely with leading cyber security experts to investigate the matter. Our investigation is ongoing, and at this time, we believe that the information is primarily limited to customer service ticket data following an incident with a third-party vendor.”

Reddit users also chimed in with their thoughts on this Crunchyroll situation:

How to Protect Yourself from Breaches

If you have a Crunchyroll account, take the following steps right now:

• Change your password immediately and update any other accounts where you used the same login credentials
• Watch your bank and credit card statements closely for charges you don’t recognize
• Stay alert for phishing emails pretending to be from Crunchyroll
• Check Have I Been Pwned to see if your email appeared in any known breach
• Visit Crunchyroll’s support website for other details

Final Thoughts from Troy

If you hold an account on the Crunchyroll platform, change your password today and keep a close eye on your financial statements.

This incident is yet another reminder that outsourcing partners can be the weakest link in any company’s security chain, and your personal data is only as protected as the least secure vendor handling it.

For more details on this story, refer to the report from BleepingComputer and this Reddit thread.

We want to know your thoughts. What do you think about this story? Let us know in the comment section below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.