Loading story…
Crunchyroll is investigating claims that a threat actor stole data tied to roughly 6.8 million users after allegedly compromising the Okta SSO account of a support agent associated with Telus International. According to the claims, malware on the agent’s device exposed credentials that were then used to access multiple internal and support platforms, including Zendesk, Slack, Google Workspace Mail, Mixpanel, MaestroQA, Wizer, and Jira Service Management. The attacker said they downloaded about 8 million Zendesk support ticket records and attempted to extort Crunchyroll for $5 million, while public reporting and dark web monitoring also pointed to circulation of sample Crunchyroll-related data in criminal forums.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned reported receiving a subset of 1.2 million email addresses from an alleged 2 million record dataset tied to the Crunchyroll breach. This represents a later disclosure of breach data beyond the initial reports about the larger Zendesk support ticket exposure.
Crunchyroll said customer information leaked online over the weekend is legitimate and appears to be primarily customer service ticket data linked to an incident involving a third-party vendor. The company said its investigation with cybersecurity experts is ongoing and that it has found no evidence of ongoing access to its systems.
Separate public reporting linked the exposure to Telus, and Telus Digital acknowledged it was investigating unauthorized access affecting a limited number of systems. This response did not validate the full set of claims made about Crunchyroll data exposure.
Crunchyroll was reported to be probing the incident after the threat actor's claims became public. As of the reporting, the company had not publicly confirmed the full scope of the alleged breach.
Reports of a possible Crunchyroll breach emerged publicly after social media posts and an alleged hacker forum listing advertised Crunchyroll-related data. SOCRadar said it observed a dark web post circulating masked email addresses and masked IP addresses as sample data.
The threat actor claimed it sent Crunchyroll extortion emails demanding $5 million after the alleged data theft. According to the report, the company did not respond to those demands.
The same actor alleged it maintained access for about 24 hours and downloaded roughly 8 million Zendesk support ticket records tied to about 6.8 million people. Reported exposed data included names, login names, email addresses, IP addresses, geographic information, ticket contents, and limited payment card data only where users had manually entered it in tickets.
A threat actor claimed it infected a Telus International support agent's device with malware and used the stolen credentials to access the agent's Okta SSO account. The alleged access reportedly opened multiple Crunchyroll-related internal and support platforms, including Zendesk, Slack, Google Workspace Mail, Mixpanel, MaestroQA, Wizer, and Jira Service Management.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
haveibeenpwned.com
Open sourcetechrepublic.com
Open sourcedatabreaches.net
Open sourcecnet.com
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourcesocradar.io
Open sourcecnet.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly **6.8 million to 7 million subscribers**. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment. The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Jul 5, 2026
**Telus Digital** confirmed it is investigating a cybersecurity incident involving **unauthorized access to a limited number of systems** after threat actors **ShinyHunters** claimed a **multi-month intrusion** and the theft of **nearly 1 petabyte of data**. Reporting indicates the alleged stolen data includes information tied to Telus’ BPO operations (which can include customer support, billing, and internal tooling for multiple client organizations) and **call records** associated with Telus’ consumer telecommunications business; Telus stated operations remain fully functional and said it has engaged external forensics support and law enforcement while it determines what data was taken and which customers were affected. Additional details attributed to ShinyHunters claim the initial access path involved **Google Cloud Platform (GCP) credentials** that were allegedly found in data previously stolen during the **Salesloft/Drift breach**, suggesting credential reuse/exposure as a key risk factor. As of the reporting cited, Telus Digital had not yet appeared on the actor’s leak site, and the company had not publicly confirmed the attacker’s identity or the specific data types impacted beyond acknowledging the incident and ongoing investigation.
Jun 29, 2026
The **ShinyHunters** extortion group claimed responsibility for a recent **Okta SSO voice-phishing (vishing)** campaign used to steal authentication codes and access victim environments. The group told reporters and researchers it used vishing to obtain Okta single-sign-on codes to compromise **Crunchbase** and **Betterment**, and then published alleged stolen data after the organizations reportedly rejected extortion demands; ShinyHunters also said additional victims exist and that more disclosures are forthcoming. ShinyHunters published alleged datasets for **Crunchbase, Betterment, and SoundCloud** on a newly launched leak site, asserting the dumps contain **PII** and large record counts (reported as **>20 million** for Betterment, **~2 million** for Crunchbase, and **~30+ million** for SoundCloud). **SoundCloud** stated it is aware of data published online allegedly taken from its organization and said its security team, supported by third-party experts, is reviewing the claim and the posted data; ShinyHunters asserted SoundCloud access was *not* obtained via SoundCloud’s Okta credentials. SoundCloud had previously confirmed a breach affecting roughly **20% of users** (about **28 million** based on public user counts), while Crunchbase and Betterment had not publicly responded at the time of reporting.
Jun 29, 2026