Crunchyroll breach flags SIU risk

Threat actor timeline places the intrusion on March 12, 2026 after attackers compromised an Okta single‑sign‑on account belonging to a TELUS Digital support agent. (techcrunch.com) The attacker says roughly 100 GB of data was exfiltrated from Crunchyroll’s analytics and support‑ticket systems during the access window. (cybernews.com) Sample ticket content reviewed by reporting reportedly included names, email addresses, IP and location data, and payment details such as expiration dates and last four digits, with the threat actor claiming a small number of full card numbers were present. (polygon.com) Crunchyroll confirmed it is investigating the incident, stating the information appears primarily limited to customer‑service ticket data and that it is working with leading cybersecurity experts. (techcrunch.com) Multiple outlets report Crunchyroll detected and had access revoked roughly 24 hours after the initial March 12 intrusion, though the attacker says data had already been extracted. (cybersecuritynews.com) Reporting traces the vector to a TELUS business‑process outsourcing relationship, with analysts calling BPO/third‑party access a high‑value supply‑chain target for wide‑scale compromises. (stateofsurveillance.org) Security coverage flagged that the exposed blend of PII and payment fragments raises credential‑stuffing, targeted phishing and synthetic‑identity risk—scenarios that can materially increase the workload and detection burden for SIUs. (webpronews.com) As of the latest press reports, Crunchyroll had not issued a direct public notification to affected subscribers and acknowledged the claims only after reporters sought comment. (troypoint.com)