Loading story…
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly 6.8 million to 7 million subscribers. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment.
The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Crunchyroll disclosed that a breach at a third-party service provider exposed subscriber information, including roughly 6.8 million to nearly 7 million email addresses. Reports indicate the compromised data related to Crunchyroll users rather than a direct intrusion into Crunchyroll's own systems.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crunchyroll is investigating claims that a threat actor stole data tied to roughly **6.8 million users** after allegedly compromising the **Okta SSO** account of a support agent associated with **Telus International**. According to the claims, malware on the agent’s device exposed credentials that were then used to access multiple internal and support platforms, including **Zendesk, Slack, Google Workspace Mail, Mixpanel, MaestroQA, Wizer, and Jira Service Management**. The attacker said they downloaded about **8 million Zendesk support ticket records** and attempted to extort Crunchyroll for **$5 million**, while public reporting and dark web monitoring also pointed to circulation of sample Crunchyroll-related data in criminal forums.
Jun 29, 2026
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026