Crunchyroll, the popular anime streaming service, is entangled in multiple class-action lawsuits following a significant data breach that appears to have compromised the personal details of millions of its users. The legal challenges, filed in California federal courts, stem from allegations that the company failed to adequately safeguard user information, which was reportedly accessed through a third-party vendor.
The breach exposed sensitive data including email addresses, usernames, IP addresses, approximate location data, user support communications, and in some instances, partial credit card details (such as the last four digits or expiration dates). A smaller number of users had full credit card numbers exposed when these were included in support tickets. The full extent of the data theft is still under scrutiny, with reports from threat actors claiming the exfiltration of 100 GB of user data from Crunchyroll’s customer analytics and ticketing systems.
Read More: iQIYI uses AI for content due to money problems
The lawsuits accuse Crunchyroll of negligence, citing a failure to implement essential security measures. Specifically, plaintiffs point to alleged deficiencies in data encryption, real-time threat monitoring, and timely breach notifications. One lawsuit, filed by plaintiff Max Agress, points to a Telus employee executing software that inadvertently granted criminals unauthorized access. Another, filed by Emilia Enfield, echoes these claims of insufficient safeguards.
The incident is reported to have occurred around March 12, 2026, with notifications to customers allegedly delayed until March 23, eleven days after the third-party vendor, Telus Digital, confirmed the breach. Crunchyroll has issued a statement acknowledging awareness of the claims and stating they are working with cybersecurity experts to investigate.
Adding to the legal pressure, a separate class-action lawsuit was filed on March 5, 2026, alleging that Crunchyroll knowingly shared subscriber viewing data with a third-party marketing company, Braze, without user consent, in violation of the Video Privacy Protection Act (VPPA). It remains unclear if this VPPA lawsuit is directly linked to the recent data breach or represents a separate privacy concern.
