Crunchyroll reportedly hit by breach exposing 100GB of user data, emails, and credit cards

A threat actor claims to have stolen around 100 GB of personal users information from Crunchyroll, in a breach that allegedly began on March 12, 2026. According to the report, the attacker gained access after an employee at Telus, Crunchyroll’s outsourcing partner, executed malware, giving them an entry point into the company’s systems.

From there, the attacker reportedly moved into sensitive environments tied to customer data and ticketing systems. Cyber Digest says a sample of the stolen data included IP addresses, email addresses, credit card details, and analytics data containing other PII. The attacker claims the data came specifically from Crunchyroll’s customer analytics and ticketing systems, creating potential risks such as identity theft, financial fraud, and targeted phishing.

Crunchyroll is said to have detected the intrusion and revoked access about 24 hours later, though the volume of data suggests the operation was planned and carried out quickly. Crunchyroll has not publicly acknowledged the breach or notified affected users, even as it faces ongoing legal scrutiny over earlier privacy concerns.