Crunchyroll crunchyroll.com Crunchyroll data breach: what happened and what to do
In March 2026 a data set allegedly from Crunchyroll's support system appeared. Have I Been Pwned lists 1,195,684 accounts, with email addresses. Larger figures from the seller are unverified.
View all 13,115 breaches- Breach date
- 12 Mar 2026
- Affected
- 1,195,684
- Data exposed
- Email addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2026, someone began selling a data set that they said came from Crunchyroll, the anime streaming service. Have I Been Pwned (HIBP) dates the breach to 12 March 2026 and added the data on 4 April 2026. It lists 1,195,684 affected accounts.
The seller claimed a bigger haul than HIBP received. Reports put the claim at 6.8 million users, and HIBP says a subset of about 1.2 million email addresses, taken from an alleged 2 million record data set, was passed to it. HIBP's entry says the data is reported to have come from Crunchyroll's customer support system, which runs on Zendesk. The larger numbers remain claims, not confirmed figures.
Accounts of what Crunchyroll has said differ. Some outlets reported the company was investigating, and others that it hadn't commented publicly. Check Crunchyroll's own help pages and any email from the company for its current position.
What was exposed
In HIBP's data, one thing: email addresses. That's far less than many breaches expose. HIBP does not list passwords, payment details or names for this one.
An early report on the seller's samples mentioned usernames, email addresses and hashed passwords. HIBP doesn't list those, and the seller's claims are unverified. If you want to be careful, treat your password as possibly exposed anyway. It costs a minute.
What criminals can do with an email address
On its own, an email isn't much. It still has three uses.
It tells a scammer you use Crunchyroll, so a fake email about a payment problem or an expiring subscription is believable. Those are the standard hooks for phishing aimed at streaming customers.
It's also a login name. Attackers try it with passwords from other breaches, hoping you reused one.
And it's a key. Combined with other leaks, an email address links your Crunchyroll account to your name, your phone number or your address.
What the breach says about support tools
HIBP says the data came from a support system, not from the streaming service itself. Support desks hold tickets, order details and conversations. That's a reminder that what you tell a company's support team can be stored for years, in a tool the company's customers never see.
If you've emailed Crunchyroll support about a billing or account problem, assume that thread could sit in a set like this. Keep sensitive details out of future tickets. A short description of the problem is enough for a support agent to help you.
Why a small breach still matters
One data field sounds minor. But 1.2 million confirmed addresses is a ready-made mailing list for anyone running phishing campaigns against anime fans, and a list tied to a specific service converts better than a random one. The best defense is dull: a unique password and a habit of not clicking through email.
What to do if you were in it
- 1
Change your Crunchyroll password
Use a long, unique one. If you used the same password anywhere else, change it there too.
- 2
Turn on two-factor authentication where it's offered
Do it on your email account first, since anyone who controls your email can reset your other accounts.
- 3
Be wary of emails about Crunchyroll billing
Messages about failed payments, plan changes or account suspensions are the usual hook. Open the app or type the address yourself instead of clicking.
- 4
Keep sensitive details out of support tickets
Don't send full card numbers, ID photos or passwords to a support desk. Reputable teams don't ask for them.
- 5
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the Crunchyroll data breach?
Search your email address on Have I Been Pwned. It lists 1,195,684 accounts. The seller claimed more records than HIBP received, so a clean result isn't a guarantee.
What was exposed?
HIBP lists email addresses only. Seller claims about other fields haven't been verified.
Where did the data come from?
HIBP's entry says it's reported to come from Crunchyroll's customer support system.
Should I change my password?
It's a sensible precaution. HIBP doesn't list passwords for this breach, but changing yours and any copy of it takes minutes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
