Supply Chain Breach Analysis

Crunchyroll Breached via Telus Supply Chain Attack

A hacker compromised a BPO employee's Okta SSO credentials and walked off with 100GB — 6.8 million anime fans' data at risk. No Crunchyroll infrastructure was directly touched.

Sable Security Research Team
March 24, 2026
0 views
8 min read
HIGH 8.6

TL;DR: What Happened

6.8M
Users Exposed
unique email addresses
100GB
Data Stolen
in under 24 hours
8M
Support Tickets
downloaded from Zendesk
1
Compromised Employee
at Telus BPO in India

Bottom line: On March 12, 2026, malware on a Telus International BPO employee's workstation gave attackers Okta SSO tokens for Crunchyroll's Zendesk. Over 24 hours, 8 million support tickets were downloaded before access was revoked. No direct Crunchyroll infrastructure compromise was needed.

What Happened

On March 12, 2026, a threat actor deployed malware on the workstation of a Telus International employee based in India. Telus International is a business process outsourcing (BPO) firm that handles customer support operations for Crunchyroll, the world's largest anime streaming platform owned by Sony.

The malware harvested the employee's Okta SSO session tokens, effectively granting the attacker seamless access to Crunchyroll's internal support infrastructure — no password required, no MFA challenge to beat.

Using those stolen credentials, the attacker accessed Crunchyroll's Zendesk platform and spent approximately 24 hours systematically downloading support ticket data before Crunchyroll detected the unauthorized access and revoked the session. By then, 100GB of data — including 8 million support tickets — had left the building.

Technical Analysis: The Attack Chain

This is a textbook supply chain credential compromise. The attacker didn't need to breach Crunchyroll's infrastructure directly — they found a softer target in a third-party vendor with privileged access.

1Initial Access via Malware

Malware deployed on a Telus International BPO employee's workstation in India — likely via phishing or malicious download.

2Okta SSO Token Theft

Session tokens harvested from browser/memory. MFA is irrelevant — auth already happened. The attacker becomes the employee.

3Zendesk Access

Stolen tokens grant full access to Crunchyroll's Zendesk customer support platform — the same access a legitimate Telus agent has.

424-Hour Exfiltration

8 million support tickets (100GB) downloaded before Crunchyroll detects the unauthorized session and revokes access.

why-okta-tokens-are-devastating.md
# Stolen session token != stolen password
MFA status: ✓ Enabled
MFA bypassed: ✓ Yes — auth already happened
System sees: Valid active session
Token theft = attacker IS the authenticated user

What Was Stolen

Email Addresses
6.8M unique
Risk: Phishing
IP Addresses
All affected users
Risk: Geolocation
Partial Card Details
Truncated numbers
Risk: Social engineering
Support Ticket Content
8M tickets
Risk: Rich context for attacks
Behavioral Data
Viewing history, analytics
Risk: Profiling

Why Support Ticket Content Is Especially Dangerous

Support tickets contain what users told support agents in plain language — their address, their payment method, the last show they watched, the device they were using. Attackers now have rich context to craft hyper-personalized phishing emails that reference your actual account history. "We noticed an issue with your subscription to [exact show you asked about last month]" is far more convincing than generic spam.

Impact: Who Is at Risk

Crunchyroll reports over 15 million paying subscribers globally, with the largest user bases in the United States, Brazil, and Japan. This breach exposed approximately 45% of their subscriber base by unique email. If you've ever contacted Crunchyroll support, your data is likely in this set.

Targeted Phishing

Attackers know your shows, your issues, your support history. Expect convincing fake billing emails.

Credential Stuffing

Your email will be fed into credential stuffing tools against banking, gaming, and other platforms.

Identity Theft

IP + email + behavior + partial card = a surprisingly complete profile for social engineering.

Legal Exposure

Crunchyroll already faces a class-action lawsuit over data sharing. This breach significantly amplifies it.

How to Protect Yourself

If you're a Crunchyroll subscriber:

P0
Change Crunchyroll password immediately
Use a strong, unique password you don't use anywhere else.
P0
Enable 2FA on your account
Two-factor authentication adds a layer attackers can't bypass with stolen passwords.
P1
Check haveibeenpwned.com
See if your email has appeared in other breaches — this won't be the last use of these addresses.
P1
Watch for phishing emails
Attackers know your support history. Emails about billing issues, subscription problems, or your favorite shows are suspect.
P1
Change passwords on reused accounts
Gaming, banking, streaming — anywhere you reused the same password.
P2
Monitor your credit card
Look for small unauthorized charges, especially under $5 that might be testing a card's validity.

For organizations using BPO or third-party vendors:

P0
Audit BPO vendor access
Do they really need full Zendesk access? Principle of least privilege applies to third parties too.
P0
Implement session token binding
Tie Okta sessions to device fingerprints and IP ranges. A token from India shouldn't work from a new IP without re-auth.
P1
Deploy EDR on vendor workstations
Require BPO partners to meet your endpoint detection standards contractually.
P1
Set data egress limits in Zendesk
8 million tickets shouldn't be downloadable in 24 hours. Volume-based anomaly detection would have caught this earlier.
P2
Anomaly detection on SSO patterns
A BPO employee suddenly bulk-downloading millions of records is a detectable signal. Build the alert.

The Bigger Picture

The Crunchyroll breach is the latest in a growing pattern of supply chain attacks targeting BPO providers. Organizations increasingly outsource customer support and data processing to third parties — and attackers have learned that these vendors often have the same access as insiders but with weaker security controls.

2023
Okta Support Vendor Breach
Attackers compromised a customer support system at an Okta vendor, exposing session tokens for Cloudflare, BeyondTrust, and 1Password.
2024
Snowflake Campaign
Credential theft via contractor malware led to breaches at Ticketmaster, Santander Bank, and AT&T — all through the same third-party access pattern.
2026
Crunchyroll / Telus BPO
Malware on a BPO employee's workstation → stolen Okta tokens → 6.8M anime fans' data exfiltrated via Zendesk.
The Pattern Is Clear

Your security is only as strong as your weakest vendor's endpoint security. As SSO and cloud SaaS adoption accelerates, stolen session tokens — not stolen passwords are becoming the primary attack vector. The industry needs to treat token theft with the same urgency as password breaches.

References

Do You Have Third-Party Vendors with Privileged Access?

Supply chain attacks target your vendors, not you directly. We audit your third-party access landscape and help you close the gaps before attackers find them.

This analysis was produced for defensive and educational purposes only. All data sourced from public reporting.