A serious cybersecurity incident appears to have hit the Sony -owned anime streaming platform Crunchyroll . Reports suggest that around 100GB of user data was stolen . The breach is reportedly linked to a malicious actor gaining access through a partner outsourcing company , highlighting once again the risks associated with third-party service providers.
The incident reportedly occurred on March 12, 2026, but so far there has been no official confirmation or announcement from Crunchyroll, which heightens concerns about transparency and crisis management in the cybersecurity sector.
The attack chain via BPO partner
According to the attacker himself, the breach was made possible when an employee of Telus, a Crunchyroll business process outsourcing (BPO) company, ran malware on his computer. This infection paved the way for the installation of an access point in the platform's internal environment.
See also: Microsoft: IRS Phishing Attack Hit 29,000 Users with RMM Malware
From there, the attacker allegedly laterally moved to critical systems , including tools directly related to users , such as the request service infrastructure and customer data analytics systems . This incident follows a broader pattern of attacks targeting BPO providers, which are attractive targets due to their access to multiple corporate environments.
Crunchyroll: The data exposed and the risks
Cyber Digest analyzed a sample of the allegedly leaked data and found that it contained highly sensitive information. This included IP addresses, user emails, credit card details, and personally identifiable information (PII). In total, it is estimated that approximately 100GB of data was extracted from Crunchyroll's systems.
The nature of this data poses serious risks to users, such as identity theft, financial fraud, and targeted phishing attacks. Cybercriminals can leverage this information to defraud subscribers or gain access to their other accounts.
Execution speed and breach detection
The attacker claims that access to the system was detected and revoked approximately 24 hours after the initial breach. However, the fact that they were able to extract such a large amount of data suggests a high degree of preparation and automation of the attack.
See also: Foster City Cyberattack: Service Outage and Data Breach Fears
Cybersecurity experts point out that such attacks are often based on predefined scripts, which are activated as soon as access is secured, allowing attackers to move quickly before being detected.
Silence and questions about transparency
Of particular concern is the fact that, according to the attacker, Crunchyroll has not responded to contact attempts or publicly informed its users about the incident. The lack of an official position raises questions about crisis management and compliance with data protection regulations.
The incident takes on even greater significance when considering that the company had already faced legal challenges in early 2026, due to allegations of unauthorized sharing of user viewing data to third-party marketing platforms.
The risks of partners and the need to strengthen security
This case highlights the growing risk posed by partnerships with third‑party service providers. BPO companies manage critical tools, such as identity and customer service systems, making them ideal targets for large‑scale attacks.
See also: Navia: Data breach affects 2.7 million people
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
For businesses, strengthening security controls on their partners is now a necessity. This includes stricter access policies, constant activity monitoring, and staff training to avoid malware attacks.
The alleged Crunchyroll breach highlights the challenges facing modern digital platforms in an environment of growing cyberthreats. Reliance on third-party partners, combined with the value of personal data, creates an explosive mix of risks. In this context, transparency , speed of response, and proactive security are critical factors in protecting both businesses and their users.
