Crunchyroll confirms vendor breach of support tickets after 6.8M-user data theft claim
A hacker claims 8M Crunchyroll Zendesk tickets (6.8M emails) via an outsourced agent's Okta account. Crunchyroll confirms support ticket data was involved.
In March 2026, Crunchyroll began investigating after a threat actor claimed to have stolen about 8 million customer support tickets containing roughly 6.8 million unique email addresses. The claimed entry point was the Okta single sign-on account of an outsourced support agent. Crunchyroll later confirmed that a third-party vendor incident exposed customer service ticket data. If you give BPO staff SSO access to your SaaS tools, read this as a case study in how one infected laptop can expose an entire support history.
What happened
The attacker told BleepingComputer they took over a support agent's Okta SSO account on 12 March 2026 at about 9 PM EST. They said the agent worked for Telus International, a business process outsourcing (BPO) firm, and that infostealer malware on the agent's machine exposed the credentials. Through that SSO session the attacker said they could reach Zendesk, Wizer, MaestroQA, Mixpanel, Google Workspace mail, a Jira service desk and Slack. They claimed access was revoked after about 24 hours, but not before they had exported the Zendesk ticket data. They then emailed Crunchyroll an extortion demand of $5 million. Crunchyroll did not respond to it.
BleepingComputer reviewed samples that contained names, login names, email addresses, IP addresses, general location and ticket contents, and the tickets referenced Telus. Payment card data appeared only where customers had typed it into tickets themselves. The attacker said most such entries were partial, such as last four digits or expiry dates. Neither BleepingComputer nor TechCrunch could verify the 8 million or 6.8 million figures.
Crunchyroll first said it was investigating with outside cybersecurity experts. It later said the exposed information was "primarily limited to customer service ticket data" from a third-party vendor incident, and that it had found no evidence of ongoing unauthorized access. Crunchyroll didn't confirm that the vendor was Telus, and Telus didn't respond to reporters. BleepingComputer reported that this incident appears unrelated to a separate ShinyHunters breach of Telus Digital disclosed around the same time.
Who is affected
- Crunchyroll users who have contacted support. Their name, email, IP address, approximate location and whatever they wrote in the ticket may be exposed.
- Users who pasted card numbers, passwords or account details into a support ticket face higher risk.
- Any company that gives outsourced agents SSO access to helpdesk, analytics and chat tools. The technique isn't specific to Crunchyroll.
What it means for developers and engineering teams
SSO reduces the number of passwords, but it also concentrates access. One Okta session opened seven applications, so the infostealer didn't need to break anything. It only needed to replay credentials or a session that a legitimate agent already held. Unless the identity provider binds sessions to a managed device and uses phishing-resistant authentication, a stolen session cookie works from any machine.
The second lesson is about data. Support tickets collect the most sensitive data customers have, written in free text, and nobody classifies it. Many helpdesks keep every ticket forever, and any agent with export rights can bulk-download years of history. Ask whether an agent working the current queue really needs access to tickets from 2019, and to the export API.
Third, BPO staff are usually your highest-volume privileged users and the ones you have least control over. Their laptops are often not your managed devices, so your EDR and device-posture checks don't reach them.
What to do now
- Require device-bound, phishing-resistant authentication for vendor agents: FIDO2 or passkeys, plus IdP device-trust policies (for example Okta Device Assurance or Entra Conditional Access with compliant-device rules).
- Shorten session lifetimes for outsourced roles and re-authenticate on IP or ASN changes.
- Restrict bulk export: turn off ticket export and API tokens for agent roles, and alert on high-volume ticket views or downloads.
- Set retention: auto-archive or delete closed tickets after a fixed period, and redact PAN-like patterns at ingestion (most helpdesks support credit-card redaction).
- Scope SSO app assignments so that a support agent's identity reaches only the apps that role needs.
- Write security terms into BPO contracts: managed endpoints, EDR, prompt incident notification, and audit rights.
- As a user, watch for phishing that cites your support history, and never put full card numbers or passwords into a ticket.