Crunchyroll Breached via BPO Partner: 100GB Allegedly Stolen, Still No Disclosure

Commissioned, Curated and Published by Russ. Researched and written with AI.

What’s New This Week

Initial publication. The breach was reported by International Cyber Digest and picked up widely on March 22-23, 2026. Crunchyroll has made no public statement as of publication time.

Changelog

On March 12, 2026, a threat actor gained access to Crunchyroll’s internal environment via a compromised employee at Telus, the BPO firm Crunchyroll uses for customer support and operations. According to reporting by International Cyber Digest, the attacker exfiltrated approximately 100GB of data from Crunchyroll’s ticketing infrastructure and customer analytics systems before being detected and cut off roughly 24 hours later.

Eleven days on, Crunchyroll – which is owned by Sony – has not issued any public statement to its subscribers.

The breach is alleged, not confirmed. The data sample was reviewed by International Cyber Digest, who reported it contained IP addresses, email addresses, credit card details, and customer analytics records. The threat actor’s claims have not been independently verified by Crunchyroll. Both the 100GB figure and the specific data categories come from the attacker’s own account, and breach claims of this type are routinely exaggerated. Treat the scope as unconfirmed until Crunchyroll or a regulator says otherwise.

What is harder to dispute is the silence.

The GDPR clock

GDPR’s Article 33 requires organisations to notify their supervisory authority of a personal data breach within 72 hours of becoming aware of it – not 72 hours after a public statement, 72 hours after internal review completes. Crunchyroll reportedly detected the breach on or around March 13. That 72-hour window closed eleven days ago.

For UK and EU subscribers, this matters directly. If Crunchyroll has customer data from those regions – and as one of the largest anime streaming services in the world, it almost certainly does – the Information Commissioner’s Office and relevant EU data protection authorities should already have been notified. Whether they were is not publicly known. Whether affected subscribers have been told is also not publicly known.

Companies don’t always breach the 72-hour rule. Sometimes they notify regulators privately and quietly within that window. But when 11 days pass with zero public communication, the reasonable inference is that something went wrong in the response process, not just the detection one.

The attack pattern

The entry point was not Crunchyroll itself. It was Telus.

A Telus employee executed malware on their workstation. That infection gave the attacker lateral movement capability into Crunchyroll’s environment – specifically into systems that Telus had legitimate access to as Crunchyroll’s outsourcing partner. From there, the attacker reached the ticketing system and customer analytics infrastructure.

This is the same attack pattern as Ticketmaster in 2024, where attackers accessed data through Snowflake, a shared cloud storage provider. It is the same pattern as Target in 2013, where attackers entered via the HVAC contractor. The direct target gets breached through a vendor who has legitimate, trusted access.

BPO providers are an attractive vector because of that access profile. A BPO handling customer support for a large consumer platform typically has credentials across ticketing, CRM, billing, and analytics. One compromised employee is one foothold into all of it. The cybersecurity news reporting noted that this incident aligns with a broader pattern of attacks against Telus Digital that have affected multiple of its client companies simultaneously – one infection, multiple breach claims.

Crunchyroll’s own perimeter apparently held. The perimeter that didn’t was Telus’s. That distinction matters, and it is one that legal teams and breach disclosure frameworks do not always reflect cleanly. Crunchyroll may privately be arguing that this was Telus’s breach, not theirs. Regulators will look at whose data walked out the door.

What this means for Crunchyroll subscribers

If the breach is real and the scope is accurate, the data at risk includes email addresses, IP addresses, and credit card details. The payment card risk is the most immediate – a stolen card number and billing address is enough for fraud. Subscribers who have a card on file with Crunchyroll should monitor statements and consider replacing the card if they want to remove the exposure entirely.

Password reuse is a secondary risk. If a Crunchyroll subscriber uses the same password elsewhere, and if passwords were stored in a way that allows recovery (hashed weakly or stored plaintext), those accounts are at risk. There is no public information yet about whether password data was included in the exfiltration.

The advice in the absence of official confirmation: change your Crunchyroll password, rotate any reused passwords, and watch your payment card statements. None of that is unusual precaution for a breach of this alleged scope.

The pattern that keeps repeating

Two weeks ago this blog covered the Trivy/CanisterWorm supply chain attack, where malware was embedded in a widely-used container scanning tool. Different vector, same fundamental problem: we extend trust to third parties and don’t always verify that trust is warranted.

The question for any organisation running vendor relationships is not whether their own systems are secure. It is whether every third party with access to their systems holds that access to the same standard. BPO providers, SaaS tools, cloud storage, contractor credentials – all of it is attack surface. Crunchyroll is the latest example, not the last one.

The silence from Crunchyroll makes this worse than it needed to be. Subscribers cannot protect themselves from a breach they don’t know happened. Customers who changed their passwords on March 14 are in a better position than customers who haven’t changed anything because nobody told them to. Every day of delay in disclosure is another day of unnecessary exposure for the people whose data was taken.

If Crunchyroll has something to say, now would be the time.