Crunchyroll support-system breach exposes customer tickets and identifying details
Crunchyroll confirmed a third-party support incident. Samples exposed customer identities and ticket contents; HIBP received 1.2 million email addresses. Watch for convincing fake support messages and change any password shared in a ticket.
If you contacted Crunchyroll support, check your email address at Have I Been Pwned and treat unexpected support or billing messages cautiously: open Crunchyroll directly instead of following their links. Change any password you shared in a ticket or reused elsewhere. If you notice unfamiliar account activity, remove unknown devices through Account Settings → Device Management and contact Crunchyroll support.
What’s happening
Crunchyroll customers whose information appeared in support tickets face exposure following a third-party support-system breach. Samples reviewed by BleepingComputer contained names, login names, email and IP addresses, approximate locations and ticket contents. It reported that exposed card details came from customers’ messages, rather than a separate payment-system breach. The attacker claimed eight million tickets covering 6.8 million unique email addresses; Crunchyroll has not confirmed those totals. The company told reporters that the information appeared mainly limited to customer-service tickets and that it had found no evidence of ongoing access while investigating. On 4 April, Have I Been Pwned added a subset containing 1.2 million email addresses. As of 3 November, the reviewed sources provide no final affected total, confirmed data recovery, completed notification programme or announced charges. No device update can remedy the disclosure.
- What
- Breach
- Affects
- Crunchyroll customer support
- Fixed in
- Nothing to patch
- Since
- 12 Mar 2026
- Closed
- 4 Apr 2026
Timeline
- Update
Have I Been Pwned added 1.2 million email addresses supplied from an allegedly two-million-record dataset offered for sale. This subset does not establish the breach’s full size.
- Update
Crunchyroll’s statement to GamesRadar+ said the information appeared mainly limited to customer-service tickets following a third-party vendor incident. Its investigation continued, with no evidence identified of ongoing access.
- Made public
BleepingComputer reported the attacker’s claim of eight million stolen tickets containing 6.8 million unique email addresses. Samples it reviewed contained identifying details and support conversations.
- UpdateNothing to patch
The attacker claimed to have gained access through a support agent’s account on this date. They said access was revoked after about 24 hours; Crunchyroll did not confirm that sequence.
Sources
- Crunchyroll probes breach after hacker claims to steal 6.8M users' data — includes Crunchyroll’s statementBleepingComputer · 23 Mar 2026
- Crunchyroll provides update on data breach claims as the investigation remains ongoingGamesRadar+ · 24 Mar 2026
- Crunchyroll Data BreachHave I Been Pwned · 4 Apr 2026
- What do I do if my account has been compromised?Crunchyroll