Crunchyroll Probes Breach Affecting 6.8 Million Users via Third-Party Vendor

The breach of Crunchyroll, the world’s leading anime streaming platform, serves as a stark reminder of the persistent vulnerabilities inherent in global supply chains and outsourced customer operations. On March 12, 2026, a threat actor successfully infiltrated the company’s internal systems, not through a direct assault on its primary servers, but by compromising a single support agent at Telus International, a major business process outsourcing (BPO) firm. This "island hopping" technique allowed the attacker to bypass traditional perimeter defenses by leveraging legitimate credentials stolen via malware.

The scale of the exposure is significant, involving approximately 6.8 million unique email addresses and 8 million support ticket records. While Crunchyroll, a subsidiary of Sony Group Corporation, has confirmed it is investigating the matter alongside cybersecurity experts, the details provided by the threat actor to BleepingComputer paint a troubling picture of lateral movement within the company’s digital ecosystem. After obtaining the agent’s Okta Single Sign-On (SSO) credentials, the hacker gained a 24-hour window of access to a suite of critical internal tools, including Zendesk, Google Workspace Mail, Slack, and Jira Service Management.

“

The $5 million ransom demand, which Crunchyroll reportedly ignored, suggests the attackers are looking for a quick payout before potentially leaking the data on underground forums.

This incident highlights a recurring theme in modern enterprise security: the "human element" remains the weakest link, particularly when that human is part of a third-party vendor’s workforce. By infecting the agent’s computer with malware, the attackers effectively turned a trusted insider into an unwitting gateway. The data exfiltrated—ranging from names and IP addresses to geographic locations and the contents of support inquiries—provides a goldmine for secondary phishing attacks. Although primary payment information like full credit card numbers appears to have remained secure, the inclusion of partial card data or expiration dates within support tickets remains a possibility for users who may have shared such details during troubleshooting.