TL;DR: What Happened
Bottom line: On March 12, 2026, malware on a Telus International BPO employee's workstation gave attackers Okta SSO tokens for Crunchyroll's Zendesk. Over 24 hours, 8 million support tickets were downloaded before access was revoked. No direct Crunchyroll infrastructure compromise was needed.
What Happened
On March 12, 2026, a threat actor deployed malware on the workstation of a Telus International employee based in India. Telus International is a business process outsourcing (BPO) firm that handles customer support operations for Crunchyroll, the world's largest anime streaming platform owned by Sony.
The malware harvested the employee's Okta SSO session tokens, effectively granting the attacker seamless access to Crunchyroll's internal support infrastructure — no password required, no MFA challenge to beat.
Using those stolen credentials, the attacker accessed Crunchyroll's Zendesk platform and spent approximately 24 hours systematically downloading support ticket data before Crunchyroll detected the unauthorized access and revoked the session. By then, 100GB of data — including 8 million support tickets — had left the building.
Technical Analysis: The Attack Chain
This is a textbook supply chain credential compromise. The attacker didn't need to breach Crunchyroll's infrastructure directly — they found a softer target in a third-party vendor with privileged access.
Malware deployed on a Telus International BPO employee's workstation in India — likely via phishing or malicious download.
Session tokens harvested from browser/memory. MFA is irrelevant — auth already happened. The attacker becomes the employee.
Stolen tokens grant full access to Crunchyroll's Zendesk customer support platform — the same access a legitimate Telus agent has.
8 million support tickets (100GB) downloaded before Crunchyroll detects the unauthorized session and revokes access.
What Was Stolen
Why Support Ticket Content Is Especially Dangerous
Support tickets contain what users told support agents in plain language — their address, their payment method, the last show they watched, the device they were using. Attackers now have rich context to craft hyper-personalized phishing emails that reference your actual account history. "We noticed an issue with your subscription to [exact show you asked about last month]" is far more convincing than generic spam.
Impact: Who Is at Risk
Crunchyroll reports over 15 million paying subscribers globally, with the largest user bases in the United States, Brazil, and Japan. This breach exposed approximately 45% of their subscriber base by unique email. If you've ever contacted Crunchyroll support, your data is likely in this set.
Attackers know your shows, your issues, your support history. Expect convincing fake billing emails.
Your email will be fed into credential stuffing tools against banking, gaming, and other platforms.
IP + email + behavior + partial card = a surprisingly complete profile for social engineering.
Crunchyroll already faces a class-action lawsuit over data sharing. This breach significantly amplifies it.
How to Protect Yourself
If you're a Crunchyroll subscriber:
For organizations using BPO or third-party vendors:
The Bigger Picture
The Crunchyroll breach is the latest in a growing pattern of supply chain attacks targeting BPO providers. Organizations increasingly outsource customer support and data processing to third parties — and attackers have learned that these vendors often have the same access as insiders but with weaker security controls.
Your security is only as strong as your weakest vendor's endpoint security. As SSO and cloud SaaS adoption accelerates, stolen session tokens — not stolen passwords are becoming the primary attack vector. The industry needs to treat token theft with the same urgency as password breaches.
References
Do You Have Third-Party Vendors with Privileged Access?
Supply chain attacks target your vendors, not you directly. We audit your third-party access landscape and help you close the gaps before attackers find them.
This analysis was produced for defensive and educational purposes only. All data sourced from public reporting.