Millions Exposed in Anime Streamer Data Breach

A class-action lawsuit was filed in a California federal court against Crunchyroll following a significant data breach that occurred in March 2026. This incident exposed the personal information of approximately 6.8 million users, impacting sensitive data including email addresses and, in a limited number of cases, credit card numbers. The breach reportedly originated from a third-party supplier, Telus, which provided operational support to the streaming service. Hackers allegedly deployed malware to gain access to internal systems, downloading millions of support ticket records.

The lawsuit, filed by plaintiff Max Agress, asserts that Crunchyroll violated state and federal consumer protection laws by failing to implement reasonable security measures. These alleged failures include insufficient monitoring of system security and delayed notification to affected users. The exposed data could facilitate identity fraud and financial theft. Experts warn that such breaches highlight the risks associated with collecting extensive user data and emphasize the need for stringent cybersecurity practices across the streaming industry.

Crunchyroll stated its investigation is ongoing and that it is cooperating with cybersecurity experts. The company indicated that the compromised information was primarily limited to customer service ticket data resulting from an incident involving a third-party vendor. They have not identified evidence of continued unauthorized access to their systems. The breach, publicly disclosed on March 22, 2026, is considered one of the largest impacting an entertainment streaming platform this year.