15-Year-Old Saitama Student Uses ChatGPT to Mass-Cancel 46,812 Bandai Channel Subscriptions, Triggering Service Outage and Data Breach Concerns

A 15-year-old student from Saitama Prefecture has been arrested for orchestrating a sophisticated cyber attack that resulted in the mass cancellation of 46,812 user subscriptions on the popular anime streaming service Bandai Channel, operated by Bandai Namco Filmworks.

According to Japanese police, the teenager developed a custom program capable of simulating legitimate user requests to delete accounts. The original code, written while he was still in middle school, processed requests too slowly, prompting the student to consult ChatGPT and rewrite the script in a more efficient programming language.

On November 4, 2025, the optimized program was used to flood the service’s servers with fraudulent deletion commands, causing the platform to automatically terminate tens of thousands of accounts and forcing the company to suspend operations temporarily.

When Bandai Namco Filmworks attempted to block the attacker’s access, the student evaded detection by rotating his IP address more than 30 times, demonstrating that the assault was deliberate and sustained rather than accidental.

Investigators later discovered that the same individual had already come to police attention in June, when he was detained in connection with other computer crimes. During questioning, the teenager stated that he held no grudge against the company and had acted simply to gain access to a large number of user accounts.

Company Response and Data Protection Concerns

Bandai Namco Filmworks filed a formal complaint with the Tokyo Metropolitan Police Department in November 2025. In December, the company publicly acknowledged a possible compromise of personal information belonging to up to 1.36 million accounts, including email addresses, account balances, and payment details.

Despite the scale of the potential exposure, the firm confirmed that no evidence of data publication or secondary misuse has been detected. The company stated it takes the incident seriously and will implement regular security audits to prevent recurrence.

Police officials warned that the perceived anonymity of the internet can create a false sense of impunity, noting that such actions carry serious legal consequences regardless of the perpetrator’s age.