A cybersecurity breach has impacted global anime streaming service Crunchyroll after hackers infiltrated company systems through a compromised third-party vendor, exposing sensitive user information and raising fresh concerns over targeted online scams.
The intrusion reportedly began when attackers gained access through Telus Digital, an external service provider connected to Crunchyroll’s operational network. Security researchers say malware deployed during the incident allowed unauthorized entry into internal systems tied to Okta single sign-on authentication services, giving attackers limited access for nearly 24 hours.
Crunchyroll stated that account passwords were not stolen. However, investigators confirmed that hackers obtained other personal data, including email addresses, usernames, real names, IP information, approximate geographic locations and detailed customer support records. These support tickets contained billing discussions, account complaints and user interaction histories, information experts warn could be used to craft highly convincing phishing attempts.
According to reports, the breach began around March 12. Days later, threat actors claimed they possessed a database containing millions of user emails, with portions of the dataset later appearing for sale on underground forums. On April 4, approximately 1.2 million exposed email addresses were independently verified through Have I Been Pwned, confirming that real user data had been compromised.
Cybersecurity analysts describe the incident as a supply-chain attack, an increasingly common tactic where hackers target external vendors to bypass a company’s direct security defenses. Rather than focusing solely on passwords, attackers are now seeking contextual information that allows them to impersonate legitimate companies and deceive users more effectively.
Experts are urging affected users to update passwords, enable two-factor authentication and remain cautious of unexpected emails or messages referencing account activity or billing issues.
