A threat actor claims to have stolen around 100 GB of sensitive user data from Crunchyroll after breaching systems via a compromised employee at outsourcing partner Telus.
The alleged incident, said to have occurred on March 12, 2026, has not been publicly confirmed by Crunchyroll.
According to the attacker, the breach began when a Telus employee executed malware on their workstation, giving unauthorized access to Crunchyroll’s internal systems. This foothold reportedly allowed lateral movement into critical infrastructure, including customer support and ticketing platforms.
The method mirrors a broader trend seen in recent incidents involving Telus Digital, where attackers targeted business process outsourcing (BPO) providers to access multiple client environments through a single compromise. Such providers are high-value targets due to their role in handling authentication, billing, and customer data across organizations.
A sample of the allegedly stolen data reviewed by Cyber Digest includes:
- IP addresses
- Email addresses
- Credit card details
- Customer analytics data containing personally identifiable information
The attacker claims the data was extracted from Crunchyroll’s analytics environment and ticketing systems, raising risks of identity theft, financial fraud, and phishing attacks.
Crunchyroll reportedly detected the intrusion and revoked access within 24 hours. However, the scale of the data theft suggests the operation was pre-planned and executed rapidly.
The threat actor also alleges that Crunchyroll has not responded to communications or disclosed the incident publicly. This is particularly notable as the company is already facing legal scrutiny over alleged sharing of user data with third-party marketing platforms earlier in 2026.
Crunchyroll is yet to comment, and the situation remains under close observation as more details emerge.
Comments