Change your passwords. Right now. If you have an active Crunchyroll account, your email, IP address, and private data could already be in the hands of an anonymous buyer on the black market.
Security researchers have confirmed that user data stolen last month didn’t just vanish—it was sold to an unknown party. The breach that began as a contained incident has become something far messier.
How the Breach Unfolded
On , an employee at an external IT support firm in India—Crunchyroll had outsourced its technical helpdesk—clicked something they shouldn’t have. Malware infected their machine. Within hours, an attacker moved through Crunchyroll’s servers unimpeded.
The haul was staggering:
- 8 million records downloaded in 24 hours
- 6.8 million unique email addresses
- IP addresses and real names
- Complete text of support tickets and complaints from paying subscribers
Every frustrated message about billing glitches or broken subtitles—scooped up and bundled for sale.
The Attacker and the Aftermath
The perpetrator, operating under the moniker Mr. Raccoon, demanded a ransom. Crunchyroll didn’t pay. The result: over 1.2 million profiles have already been sold. The remainder will likely appear on Have I Been Pwned shortly.
The company’s response took too long. The community was left waiting for days before any meaningful statement emerged. On the black-market transaction? Near-total silence from corporate communications.
What You Need to Do Immediately
If you’re a Crunchyroll subscriber, assume you’ve been compromised. Take action now:
- Change your password today—not tomorrow, not “later”
- Enable two-factor authentication everywhere, not just here
- If you reuse passwords across platforms,
that approachthat habit needs to end permanently - Check Have I Been Pwned when the data surfaces
The entertainment industry presents itself as sleek and modern. Yet user data often receives about as much protection as leftovers in a shared office fridge. We hand over personal information to watch animated series—and gamble that someone, somewhere, invested in proper security.
Are we treating digital security as seriously as locking our front doors? Should companies face stricter consequences for outsourcing critical functions without oversight? When did we decide that surrendering personal data to watch cartoons was a reasonable price?
Don’t wait for a suspicious email to arrive. Secure your profile now.
Leave a Comment