Crunchyroll Lawsuit: March 2026 Data Breach and Video Privacy Claims

Crunchyroll is an anime streaming service that CNET has described as a joint venture of Sony Pictures Entertainment and Aniplex. According to the class action complaint filed March 24, 2026, an unauthorized third party got into Crunchyroll's systems on or about March 12, 2026 after an employee of Telus, one of Crunchyroll's outsourcing partners for customer support, ran malware. The complaint says the attacker extracted more than 8 million customer support tickets containing 6.8 million unique email addresses.

The complaint lists information that may have been exposed:

• Full names and usernames
• Email addresses and IP addresses
• Approximate location data
• The content of support conversations
• Partial payment card details, such as the last four digits or expiration date

The complaint says the public first learned of the incident from a social media post around March 22, 2026, and that Crunchyroll issued a statement that it was investigating on March 23, 2026. It also notes that "the full extent of what hackers took" was still under investigation when the suit was filed. Support tickets are a less obvious target than a customer database, but they often hold the details people type when asking for help, such as billing questions and account recovery information.

This was a data breach at a vendor, which is increasingly common. Crunchyroll remains responsible for data it collects, but the vendor relationship can complicate who is liable. The allegations are unproven.

Data breach suits (dismissed without prejudice)

Agress v. Crunchyroll, LLC, No. 3:26-cv-02553, was filed March 24, 2026 in the Northern District of California. It alleged Crunchyroll ignored FTC security guidance and industry standards. A second suit, Enfield v. Crunchyroll LLC, No. 3:26-cv-02714, followed on March 27, 2026 in the same court. The plaintiff in Agress filed a notice of voluntary dismissal without prejudice on June 15, 2026, and the Enfield plaintiff did the same on June 17, 2026. Dismissal without prejudice means the claims were not decided and could be refiled, but no breach case is active in federal court right now, and there is no settlement.

Video privacy suit over the Braze SDK (pending)

Cabonios v. Crunchyroll, LLC, No. 2:26-cv-02373, was filed March 5, 2026 in the Central District of California before Judge Josephine L. Staton. The plaintiffs, California residents including minors, allege Crunchyroll embedded a software development kit made by Braze Inc. in its app since at least 2022 and used it to send users' email addresses, device identifiers, and the titles of videos they watched to Braze for targeted marketing, for both free and paid accounts.

Crunchyroll first moved to dismiss, to transfer the case to the Southern District of New York, and to compel arbitration. After the plaintiffs amended their complaint on June 22, 2026, Crunchyroll filed a new motion to compel arbitration on July 22, 2026. The plaintiffs opposed it in August, and Crunchyroll filed its reply on September 10, 2026. As of September 26, 2026, the court had not ruled on whether the VPPA claims must go to individual arbitration.

For the data breach, the people most at risk are those who wrote to Crunchyroll customer support before March 2026, since the stolen data came from support tickets. If you never contacted support, your exposure may be limited to your email address, if it was exposed at all. The strongest individual claims come from people who can link fraud or real costs to the breach.

For the video privacy case, the proposed class centers on people who created a Crunchyroll account and watched videos in the app, where the Braze SDK allegedly ran. Paid and free users are both included in the complaint's theory.

Who probably does not qualify for anything now:

• People looking to join the $16 million VPPA settlement, which covered subscribers from September 8, 2020 to September 20, 2023 and has closed.
• People with no Crunchyroll account and no support history.
• People who agreed to Crunchyroll's terms and are bound by its arbitration clause, if the court enforces it. That would not erase a claim, but it could mean pursuing it individually.

The past Crunchyroll VPPA settlement gives the best real-world benchmark. In an earlier class action filed against Crunchyroll's parent company, Crunchyroll agreed to pay $16 million to resolve claims that it shared subscribers' information with Facebook, Google Analytics, and Adobe Analytics without consent. Payouts in the $16 million Crunchyroll settlement were expected to be about $30 per claimant. Crunchyroll denied wrongdoing.

Claim	What the law allows	Status
VPPA (Braze SDK)	$2,500 per person	Pending
CCPA (breach)	$100 to $750 per incident	No active case
Negligence (breach)	Actual losses	No active case
2023 VPPA settlement	About $30 per claim	Closed

The gap between the $2,500 statutory figure and the roughly $30 actually paid is typical. Settlements trade the risk of losing for a certain but smaller fund split among everyone who files. Under the California Consumer Privacy Act, breach damages apply only to California residents and only if certain nonencrypted personal information was taken. See how much a data breach settlement is worth and how class action money is divided.

Video Privacy Protection Act, 18 U.S.C. § 2710. Passed in 1988, the VPPA bars a "video tape service provider" from knowingly disclosing information that identifies a person as having requested or obtained specific video materials, unless the person gave separate, informed written consent. Courts have applied it to streaming services. A person whose information is disclosed in violation of the VPPA can recover actual damages but not less than $2,500 in liquidated damages, plus attorney fees. Our VPPA explainer covers how tracking pixels and SDKs fit in.

Data breach claims. The Agress complaint relied on negligence, Section 5 of the FTC Act as a standard of care, the California Customer Records Act, the California Consumer Privacy Act, and the Unfair Competition Law. These theories require proof that the company's security was unreasonable and, for most of them, that people suffered real harm.

Arbitration. Streaming services commonly require users to accept an arbitration clause and a class action waiver in their terms. If a court enforces Crunchyroll's clause, each user would bring claims individually. Courts look closely at whether users actually saw and agreed to the terms, and whether minors can be bound.

The notices of voluntary dismissal filed in June 2026 do not give a reason, and no settlement was announced with them. Plaintiffs drop early data breach cases for several common reasons: the stolen data turns out to be less sensitive than first reported, the company's terms of service contain a class action waiver that makes a class case hard to maintain, or counsel decides to wait for more facts. We do not know which, if any, applied here. The dismissals also do not mean Crunchyroll admitted or disproved anything about the breach; the court never reached the merits.

Because both breach cases were dismissed without prejudice, the claims were never decided and could be refiled. New suits could follow if Crunchyroll sends formal breach notices describing more sensitive data, if state regulators take action, or if the stolen support tickets start showing up in fraud.

How the Braze case differs from the 2023 settlement

The $16 million settlement covered subscribers from September 8, 2020 to September 20, 2023 and involved sharing with Facebook, Google Analytics, and Adobe Analytics. The Cabonios case targets a different company, Braze, and alleges sharing that continues today and reaches free users as well as paid subscribers. Crunchyroll may argue that the earlier settlement's release covers some of the same period. How that plays out, and whether the case stays in court at all, depends on the pending arbitration ruling.

If you filed a claim in the 2023 settlement, that does not stop you from being part of the new case for later conduct. If you opted out of the 2023 settlement, you kept your own claims for that period, subject to the VPPA's two-year limit. If you are unsure which applies to you, the notice you received in 2023, or your email records from that time, will show whether you filed a claim or opted out.

• Data breach: the incident date is March 12, 2026. State statutes of limitations for negligence and consumer claims usually run 2 to 4 years, so there is time, but the dismissed suits no longer pause the clock the way a pending class action would.
• VPPA: the statute requires suit within two years of the disclosure or its discovery. Because the Braze sharing is alleged to be ongoing, recent viewing activity is inside that window.
• 2023 settlement: the $16 million claim period is over and late claims are not accepted.

If a settlement is reached in Cabonios, the notice will list a claim deadline and dates to opt out or object.

1. Change your Crunchyroll password, and any other account that used the same one.
2. Be suspicious of "Crunchyroll support" emails. Stolen support tickets make convincing phishing possible because scammers can reference your real past requests.
3. Check your card statements since March 2026, especially if you gave billing details to support.
4. Save any notice Crunchyroll sends about the incident, plus records of fraud and time spent fixing it.
5. Keep your account history. For the VPPA case, the account email and viewing activity are what matter. Do not delete your account just to stop tracking without first saving what you need, since deletion can erase records that show when you used the app.

Our guide on what to do after a data breach notice goes step by step. If you had fraud tied to the breach or want to know whether you fit the video privacy case, independent attorneys who handle these claims can review it. A free case review takes about two minutes.