- Crunchyroll confirms cyber attack via third-party vendor
- Hacker gained access to support agent’s Okta account, exfiltrated 8M tickets with 6.8 million emails
- The attacker demanded a $5m ransom; company investigating payment data not directly compromised
Anime streaming platform Crunchyroll has confirmed it suffered a cyber attack and said it is currently investigating allegations of data theft.
A threat actor working for an unknown hacker group recently shared Bleeping Computer they had infected a support agent’s computer with malware and gained access to their Okta SSO account for 24 hours.
This agent, who apparently worked for the Telus International Business Process Outsourcing (BPO) company, had access to Crunchyroll’s support tickets, which the attacker exfiltrated — and by accessing Zendesk, they managed to pull eight million support tickets that allegedly contained 6.8 million unique email addresses.
The article continues below
Hundreds of compromised websites
Other data apparently stolen during the attack includes people’s usernames, login names, email addresses, IP addresses, general geographic locations and the content of support tickets.
No payment information was accessed unless shared in the ticket. They also got access to other apps, such as Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management and Slack.
Crunchyroll has confirmed the incident and that it is investigating.
“We are aware of the recent allegations and are currently working closely with leading cybersecurity experts to investigate,” Crunchyroll said.
“Our investigation is ongoing and we continue to work with leading cybersecurity experts. At this time, we believe the information is primarily limited to customer service ticket data following an incident with a third-party vendor.”
“We have not identified evidence of ongoing access to systems related to these claims. We continue to monitor the situation closely.”
The publication claims that the hacker tried to blackmail Crunchyroll for money and demanded $5 million in exchange for deleting the stolen data, but the company did not respond to the offer.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
