Crunchyroll Data Breach Exposes 1.2 Million User Email Addresses

Crunchyroll Data Breach Exposes 1.2 Million User Email Addresses

On April 6, 2026, Crunchyroll, the popular anime streaming platform owned by Sony, confirmed a significant data breach that exposed the email addresses of approximately 1.2 million users. The breach was first reported by UpGuard on April 7, 2026, following the addition of these email addresses to the Have I Been Pwned database. UpGuard

Details of the Breach

The incident originated in March 2026 when an unidentified threat actor compromised a support agent account at Telus International, a third-party service provider utilized by Crunchyroll. This unauthorized access led to the exposure of sensitive user information, including:

• Names
• Usernames
• Email addresses
• IP addresses
• Geographic location data
• Support ticket contents

The breach was discovered on April 1, 2026, and publicly reported on April 6, 2026. UpGuard

Impact on Users

While the breach did not expose financial information or passwords, the compromised data increases the risk of phishing attacks and social engineering attempts. Users should remain vigilant for suspicious emails or communications that may attempt to exploit the exposed information.

Crunchyroll's Response

In response to the breach, Crunchyroll has taken the following actions:

• Notified affected users about the incident
• Implemented additional security measures to prevent future breaches
• Conducted a thorough review of their third-party service providers' security protocols

Users are advised to monitor their accounts for any unusual activity and to be cautious of unsolicited communications requesting personal information.

Recommendations for Users

To mitigate potential risks associated with this breach, users should consider the following steps:

• Be cautious of phishing emails that may appear to come from Crunchyroll or related services
• Do not click on suspicious links or provide personal information in response to unsolicited requests
• Regularly update passwords and use unique passwords for different accounts
• Enable two-factor authentication (2FA) where available

Staying informed and proactive can help minimize the potential impact of data breaches.

Conclusion

The Crunchyroll data breach serves as a reminder of the importance of robust security measures, especially when third-party service providers are involved. Users should remain vigilant and take proactive steps to protect their personal information in the wake of such incidents.