Crunchyroll Investigates Attacker’s Claim of 6.8 Million Users’ Data Theft
Summary
Crunchyroll is investigating an attacker’s claim that credentials from a Telus International support agent’s Okta account enabled access to its apps and theft of 8 million support tickets containing about 6.8 million unique email addresses.
Key points
- An attacker claimed access began on March 12 after compromising an Okta SSO account used by a Telus International support agent.
- The attacker alleged malware was used to steal the agent’s credentials and access Crunchyroll applications including Zendesk, Slack, and Google Workspace Mail.
- The attacker said they downloaded 8 million Zendesk support tickets, including about 6.8 million unique email addresses.
- Ticket samples reviewed by BleepingComputer contained names, login names, email addresses, IP addresses, general location data, and ticket contents.
- BleepingComputer reported that credit card details appeared only when customers included them in tickets; few reportedly contained full card numbers.
- The attacker claimed access was revoked after 24 hours and demanded $5 million to prevent public release of the data; the company said it was investigating.
Article Details
- Victim Organization
- Crunchyroll
- Incident Type
- Claimed data breach involving alleged malware-based credential theft from a Telus International support agent and access to Crunchyroll applications.
- Data Types Exposed
- Names
- Login names
- Email addresses
- IP addresses
- General geographic locations
- Support ticket contents
- Credit card details included by customers in support tickets
- Affected Records
- The threat actor claimed to download 8 million support ticket records, including approximately 6.8 million unique email addresses. BleepingComputer reported seeing samples of support tickets.
- Affected Data Size
- Not disclosed
- Operational Impact
- The attacker said access was revoked after 24 hours and that data could be stolen up to mid-2025. Crunchyroll said it was investigating with cybersecurity experts. No service disruption was reported.
- Ransom Or Extortion
- The attacker claimed to demand $5 million in exchange for not publicly leaking the data and said Crunchyroll did not respond.
- Claim Status
- claimed
MITRE ATT&CK
Vendors
Products
Google Workspace MailMalware was allegedly used to steal the agent’s credentials, granting access to Crunchyroll apps like Zendesk, Slack, and Google Workspace Mail.Jiro Service ManagementFrom screenshots shared with BleepingComputer, these credentials gave access to various Crunchyroll applications, including Zendesk, Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management, and Slack.MaestroQAFrom screenshots shared with BleepingComputer, these credentials gave access to various Crunchyroll applications, including Zendesk, Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management, and Slack.MixpanelFrom screenshots shared with BleepingComputer, these credentials gave access to various Crunchyroll applications, including Zendesk, Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management, and Slack.OktaCrunchyroll is investigating a breach after attackers claimed to have stolen personal information for approximately 6.8 million users by compromising an Okta SSO account of a Telus International support agent.SlackMalware was allegedly used to steal the agent’s credentials, granting access to Crunchyroll apps like Zendesk, Slack, and Google Workspace Mail.WizerFrom screenshots shared with BleepingComputer, these credentials gave access to various Crunchyroll applications, including Zendesk, Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management, and Slack.Zendesksay they used malware to obtain credentials, accessed multiple Crunchyroll applications including Zendesk to download 8 million support tickets, and demanded $5 million in extortion while credit card exposure