- Crunchyroll confirms cyberattack via third-party provider
- Hacker accessed support agent’s Okta account and extracted 8 million tickets with 6.8 million emails
- The attacker demanded a ransom of 5 million dollars; company investigating, payment data not directly committed
Anime streaming platform Crunchyroll confirmed it had suffered a cyberattack and said it was currently investigating allegations of data theft.
A threat actor working for an unknown hacking group recently said beepcomputer They infected a support agent’s computer with malware and gained access to his Okta SSO account for 24 hours.
This agent, who apparently worked for the business process outsourcing (BPO) company Telus International, had access to Crunchyroll support tickets, which the attacker exfiltrated, and by accessing Zendesk, they managed to obtain eight million support tickets, which allegedly contained 6.8 million unique email addresses.
Article continues below.
Hundreds of sites compromised
Other data apparently stolen in the attack includes usernames, login names, email addresses, IP addresses, general geographic locations, and the contents of support tickets.
Payment information was not accessed unless it was shared on the ticket. They were also allowed to access other applications, such as Wizer, MaestroQA, Mixpanel, Google Workspace Mail, Jiro Service Management and Slack.
Crunchyroll has confirmed the incident and is investigating it.
“We are aware of the recent claims and are currently working closely with leading cybersecurity experts to investigate the matter,” Crunchyroll said.
“Our investigation is ongoing and we continue to work with leading cybersecurity experts. At this time, we believe the information is primarily limited to customer service ticket data following an incident with a third-party vendor.”
“We have not identified evidence of continued access to systems in connection with these claims. We continue to monitor the situation closely.”
The publication claims that the hacker attempted to extort money from Crunchyroll, demanding $5 million in exchange for deleting the stolen data, but the company did not respond to the offer.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
