A hacker is said to have stolen about 100 GB of personally identifiable information (PII) from Crunchyroll, the Sony-owned anime streaming giant This article explores stolen data telus. . They got in through a compromised employee at Telus, the platform's outsourcing partner.
Crunchyroll hasn't said anything publicly about the breach, which is said to have happened on March 12, 2026. Find more Firewall solutions Software for encrypting data The person who contacted Cyber Digest and claimed to be the threat actor said that the breach happened because an employee at Telus Crunchyroll's business process outsourcing (BPO) partner ran malware on their workstation. This infection gave the attacker a way into Crunchyroll's internal systems, which let them move laterally into sensitive systems that customers use, like the company's ticketing infrastructure.
This attack vector fits into a larger pattern seen in the Telus Digital incident that was confirmed on March 12, 2026. In that case, hackers said they had stolen data from Telus and many other companies that use Telus for BPO services like customer support, AI data operations, and content moderation. Because BPO providers manage authentication and billing tools in many different client environments, they are still high-value targets for threat actors who want to get the most out of a single breach.
Attackers Taking Data Out Cyber Digest looked at a sample of the stolen data that the threat actor gave them. This data included very private types of customer information, such as: IP addresses Addresses for email Information about credit cards Customer analytics data (PII) The person behind the attack says that 100 GB of data was taken from Crunchyroll's ticketing system and customer analytics environment. The type of data that was leaked puts affected subscribers at a high risk of identity theft, financial fraud, and phishing campaigns that are aimed at them.
The threat actor said that Crunchyroll found out about the breach and took away their access about 24 hours after it happened on March 12, 2026. Even though the access window was only a few hours long, the amount of data stolen shows that the attacker had planned the attack ahead of time and moved quickly once inside.
The threat actor also told Cyber Digest that Crunchyroll has not responded to any of their messages about the incident and has not told affected customers about it in public. This is even more concerning. Learn more Software that finds threats Tools to stop hacking Service for scanning for vulnerabilities This silence is especially worrying because Crunchyroll was already being sued in a class-action lawsuit in early 2026 for allegedly sharing user viewing data with third-party marketing platforms without permission.
At the time this was published, Crunchyroll had not yet responded to requests for comment. ZeroOwl will keep an eye on this story as it develops. Follow us on Facebook, Twitter, and LinkedIn for daily updates on cybersecurity. Get in touch with us to have your stories featured.
