Crunchyroll probes breach after hacker claims to steal 6.8M users’ data: “Our investigation is ongoing & we continue to work with leading cybersecurity experts. At this time we believe that the info is primarily limited to customer service ticket data following an incident with a third-party vendor”

**Full Statement from Crunchyroll:**

>”Our investigation is ongoing, and we continue to work with leading cybersecurity experts. At this time, we believe that the information is primarily limited to customer service ticket data following an incident with a third-party vendor,” Crunchyroll shared in a later statement.

> “We have not identified evidence of ongoing access to systems in relation to these claims. We are continuing to monitor the situation closely.”

Main Excerpt from the Article:

This statement comes after a threat actor contacted BleepingComputer last Thursday and claimed they breached Crunchyroll on March 12th at 9 PM EST, after gaining access to the Okta SSO account of a support agent working for Crunchyroll.

This support agent is allegedly an employee of the Telus International business process outsourcing (BPO) company, who has access to Crunchyroll support tickets. The threat actors claimed to have used malware to infect the agent’s computer and gain access to their credentials.

Using this access, the attackers say they downloaded 8 million support ticket records from Crunchyroll’s Zendesk instance. Of these records, there are allegedly 6.8 million unique email addresses.

Samples of the support tickets seen by BleepingComputer and then deleted contain a wide variety of information, including the Crunchyroll user’s name, login name, email address, IP address, general geographic location, and the contents of the support tickets.

While other reports on the incident claim that credit card information was exposed, BleepingComputer has confirmed that credit card details were exposed only when the customer shared them in the support ticket.

For the most part, this included only basic information, such as the last four digits or expiration dates, and only a few contained full card numbers, according to the threat actor.

The attacker says their access was revoked after 24 hours, letting them steal data up to mid-2025.

The hacker claims to have sent extortion emails to Crunchyroll, demanding $5 million in exchange for not publicly leaking the data, but did not receive a response from the company.

Top people are working on it.