Last updated 2 weeks ago
Crunchyroll, a major anime streaming platform in the technology sector, confirmed a data breach involving customer service ticket information that was leaked online over the weekend of March 21-23, 2026. The company publicly disclosed the incident on March 25, 2026, stating their investigation is ongoing with cybersecurity experts. The breach exposed customer information contained within support tickets, though specific record counts and affected user populations remain unquantified.
An unauthorized actor gained access to and exfiltrated data from Crunchyroll's customer service systems, specifically targeting information contained within support tickets. The attack vector involved unauthorized access to the company's infrastructure, though the specific initial access method and exploitation techniques remain under investigation. The compromised data includes customer information submitted through support channels, though the company has not specified the exact data elements contained within the stolen tickets.
The company has engaged cybersecurity experts to investigate the incident and assess the full scope of the breach. Crunchyroll has not disclosed whether regulatory notifications have been filed or whether any containment or remediation milestones have been reached. The investigation remains ongoing to determine the extent of the compromise and identify any additional affected systems or data.
Hacker stole data related to customer service tickets
Record count established at 1,195,684 breached accounts from a subset of 2M records being sold, with specific data types including name, login name, email address, IP address, geographic location, and support ticket contents from the Zendesk support system.
This breach demonstrates that customer service systems containing support ticket data represent a valuable target for attackers, even in entertainment technology companies. The incident highlights the need for robust access controls and monitoring around customer support platforms, which often contain sensitive customer information outside of core account databases. Organizations must apply equivalent security rigor to ancillary systems like customer service platforms as they do to primary user data repositories.
Sign in to join the discussion.
Company
Industry
Location
Disclosed
Records Affected
Attack Vector