Crunchyroll is potentially facing a data breach with unverified claims that attackers accessed a large portion of its data via an outsourcing partner.

A sample of the allegedly stolen data reviewed by Cyber Digest includes IP addresses, email addresses, credit card information, and customer analytics tied to user behavior.

Initial access is alleged to have come from malware on a compromised Telus employee workstation, enabling movement into Crunchyroll’s internal systems including customer support and ticketing tools.

Analysts warn that third-party risk and outsourcing are critical cybersecurity concerns, showing how vendor compromises can broaden exposure.

Readers are urged to take steps to protect their accounts and to beware of scams targeting users in the wake of the breach.

Experts stress the need for tighter oversight of third-party access and stronger security practices as digital ecosystems grow, with users advised to be cautious about data sharing.

Attackers value BPO provider access because it involves authentication and billing tools across multiple client environments, enabling a larger breach from a single intrusion.

The story is edited to include a CTA urging readers to subscribe to a newsletter for updates.

The incident is described as large in scale (roughly 6.8 million users) with the investigation ongoing.

There are broader concerns about Telus Digital, noting that vendors providing outsourced support can be attractive targets due to their access to multiple client systems.

The report highlights a common pattern where a weak link through a vendor enables broader access to a company’s internal systems.

If verified, the breach would raise concerns about the security of payments, emails, and personal data on subscription platforms due to third-party weaknesses.