Crunchyroll Data Breach Allegedly Exposes 100 GB of User Data

An incident involving a data breach has impacted Crunchyroll, a Sony-owned anime streaming service. Threat actors have reportedly extracted 100 GB of personally identifiable information (PII) from the platform.

The breach is reported to have occurred on March 12, 2026, due to a compromised employee at Telus, Crunchyroll's business process outsourcing (BPO) partner. As of now, Crunchyroll has not publicly acknowledged the security incident.

The attack was initiated when a Telus employee inadvertently executed malware, which allowed the attackers an initial access point. Subsequently, they moved laterally within the Telus environment to access Crunchyroll’s internal systems, specifically targeting customer-facing systems and the ticketing infrastructure.

The attackers claim to have extracted 100 GB of data from Crunchyroll’s customer analytics and ticketing systems. Security analysts have verified the presence of sensitive customer records in the stolen database, including:

User IP addresses Account email addresses Associated credit card details Internal customer analytics data

The exposure of this data poses significant risks to affected subscribers, potentially leading to phishing attacks, financial fraud, and identity theft.

According to cybersecurity sources, Crunchyroll’s security team detected unauthorized network activity and revoked access within 24 hours of the breach. However, the significant volume of data extracted indicates a well-coordinated operation.

Despite mitigating the immediate threat, Crunchyroll has not addressed public communications regarding the breach. This lack of disclosure has attracted criticism from the cybersecurity community, especially as the company is dealing with a class-action lawsuit related to user data privacy.

For further updates, refer to official channels.

Based on reporting by GBHackers.