Crunchyroll Investigates Breach of 6.8 Million Users via Third-Party Support

The reported breach of Crunchyroll represents a textbook example of the modern 'identity-centric' supply chain attack. By compromising a single endpoint belonging to a support agent at Telus International—a major Business Process Outsourcing (BPO) provider—threat actors were able to bypass traditional perimeter defenses and gain access to a suite of sensitive internal tools. This incident underscores a critical reality for global enterprises: security is only as strong as the least-protected device in a partner's network. The attackers utilized malware to harvest Okta Single Sign-On (SSO) credentials, which then granted them a 'skeleton key' to Crunchyroll’s integrated SaaS ecosystem, including Zendesk, Slack, Jira Service Management, and Google Workspace.

While the breach lasted only 24 hours before access was revoked on March 13, the volume of data exfiltrated is substantial. The hackers claim to have downloaded 8 million support ticket records, which BleepingComputer verified contained names, usernames, email addresses, IP addresses, and geographic locations. Perhaps most concerning is the exposure of the support tickets themselves. While Crunchyroll does not store full credit card details in these systems, users often inadvertently include sensitive information—such as the last four digits of a card or billing addresses—when describing subscription issues. For a platform with over 17 million paid subscribers as of early 2025, a breach affecting nearly 7 million unique emails suggests that a massive portion of its active user base is now at heightened risk of targeted phishing and social engineering attacks.

“

The attackers utilized malware to harvest Okta Single Sign-On (SSO) credentials, which then granted them a 'skeleton key' to Crunchyroll’s integrated SaaS ecosystem, including Zendesk, Slack, Jira Service Management, and Google Workspace.

This incident follows a troubling trend of BPO-related compromises. Companies like Telus International handle customer service for dozens of Fortune 500 firms, making them high-value targets for 'hub-and-spoke' attacks. By hitting one BPO, a threat actor can potentially pivot into multiple client environments. The use of Okta as the primary target for credential theft mirrors previous high-profile incidents involving MGM Resorts and Caesars Entertainment, where social engineering or malware targeting support desks led to catastrophic system-wide access. For Crunchyroll’s parent company, Sony Group Corporation, this adds another entry to a long history of high-profile cyber incidents, though this specific event appears limited to the streaming subsidiary's support infrastructure rather than its core media delivery systems.