Tokyo police have arrested a 15-year-old high school student suspected of breaking into Bandai Channel’s systems and triggering the cancellation of more than 46,000 paid anime streaming subscriptions, according to the Tokyo Metropolitan Police Department.
The unnamed student, who lives in a city near Tokyo, is accused of finding a weakness in the servers behind Bandai Channel, a subscription anime platform, and using it to send bogus cancellation requests. Police told local media the attack forced the service offline temporarily and disrupted accounts at scale.
Police said the teenager found the flaw by studying the service’s network traffic. In plain terms, that means watching how the app and the company’s servers talked to each other, then figuring out which requests the servers would accept. Investigators allege he then used ChatGPT to help build a malicious program that automated the cancellations.
The fraudulent data was allegedly sent to Bandai Channel’s servers in November 2025, police said. The result was not a flashy defacement or a ransom note, but a very practical failure: thousands of paying users suddenly had subscriptions canceled.
How police say the attack continued
Bandai Channel’s operator detected the activity and blocked the suspect’s access, according to police. Investigators said he kept sending unauthorized cancellation requests by repeatedly changing his IP address, a basic evasion tactic that can frustrate blunt blocking rules if the underlying flaw remains reachable.
The company reported the incident to police in November. Investigators later identified the suspect through communication records, police said.
The teenager had already been arrested in June on suspicion of logging into Bandai Channel with another person’s account. Police said the later investigation tied him to the wider cancellation attack.
According to police, the boy admitted the allegations. He told investigators he had no grudge against the company, had taught himself programming, and liked analyzing network communications.
Bandai Channel stayed down for more than a month
Bandai Channel’s operator said at the time that the disruption required it to suspend the platform for more than a month while it repaired its systems and refunded affected subscribers.
The case is also a reminder that “AI-assisted” cybercrime often looks less like autonomous machine wizardry and more like a person using a chatbot as a coding assistant. Police attributed the automation tool to code developed with ChatGPT, but the alleged attack still depended on a server-side flaw, account access, traffic analysis, and repeated requests accepted by the company’s systems.
Bandai Channel is tied to one of Japan’s largest entertainment groups, which publishes some of the best-known video game franchises in the world. In 2022, Bandai Namco disclosed a separate cyberattack involving unauthorized access to systems used by several Asian subsidiaries. That incident, which the company said may have exposed customer information, was later claimed by the AlphV ransomware group.
This story draws on original reporting from The Record.
