Anime streaming platform Crunchyroll has confirmed it is investigating a potential data breach after a threat actor claimed to have stolen personal information belonging to approximately 6.8 million users.
How the Attack Unfolded
According to the attacker, the breach occurred on March 12 after they used malware to steal credentials from a support agent employed by Telus International, a BPO company handling Crunchyroll customer support. Using the agent's Okta SSO account, they accessed multiple internal platforms including Zendesk, Google Workspace, Slack, and Mixpanel.
What Data Was Exposed
The attackers downloaded approximately 8 million support ticket records from Crunchyroll's Zendesk instance. Of these, roughly 6.8 million contained unique email addresses. Exposed data includes names, usernames, email addresses, IP addresses, geographic locations, and the contents of support tickets.
Credit Card Claims Clarified
Some reports suggested credit card data was stolen. However, card details appear only in cases where users voluntarily included them in the text of their support tickets. The vast majority of such instances involve only partial card information such as the last four digits or expiry dates. A very small number of tickets contained full card numbers, according to the attacker.
Related: What is a Botnet? Definition, How It Works & Security Risks
Related: What is a Firewall? Definition, How It Works & Use Cases
Related: Windows 11 Emergency Patch KB5085516 Fixes Microsoft Account
Extortion Demand and Crunchyroll's Response
The attacker claims to have sent extortion emails to Crunchyroll demanding $5 million to prevent the stolen data from being publicly leaked. Crunchyroll has not publicly responded to the extortion demand. The company stated it is working with cybersecurity experts to investigate the matter. The attacker's access window lasted approximately 24 hours, limiting the data to records up to mid-2025.
Why BPO Companies Are a Prime Target
BPO companies have increasingly become a vector for attacks on larger organizations. By compromising a single BPO employee, threat actors can potentially access multiple client companies' data simultaneously. Recent incidents have shown attackers using social engineering, insider bribing, and malware to compromise BPO accounts — all leading to data theft or ransomware attacks at the final target companies. This incident is separate from a previously reported breach at Telus Digital itself.
