15-Year-Old Saitama Student Uses ChatGPT to Mass-Cancel 46,812 Bandai Channel Subscriptions, Triggering Service Outage and Data Breach Concerns
A 15-year-old student from Saitama Prefecture has been arrested for orchestrating a sophisticated cyber attack that resulted in the mass cancellation of 46,812 user subscriptions on the popular anime streaming service Bandai Channel, operated by Bandai Namco Filmworks.
According to Japanese police, the teenager developed a custom program capable of simulating legitimate user requests to delete accounts. The original code, written while he was still in middle school, processed requests too slowly, prompting the student to consult ChatGPT and rewrite the script in a more efficient programming language.
On November 4, 2025, the optimized program was used to flood the service’s servers with fraudulent deletion commands, causing the platform to automatically terminate tens of thousands of accounts and forcing the company to suspend operations temporarily.
When Bandai Namco Filmworks attempted to block the attacker’s access, the student evaded detection by rotating his IP address more than 30 times, demonstrating that the assault was deliberate and sustained rather than accidental.
Investigators later discovered that the same individual had already come to police attention in June, when he was detained in connection with other computer crimes. During questioning, the teenager stated that he held no grudge against the company and had acted simply to gain access to a large number of user accounts.
Company Response and Data Protection Concerns
Bandai Namco Filmworks filed a formal complaint with the Tokyo Metropolitan Police Department in November 2025. In December, the company publicly acknowledged a possible compromise of personal information belonging to up to 1.36 million accounts, including email addresses, account balances, and payment details.
Despite the scale of the potential exposure, the firm confirmed that no evidence of data publication or secondary misuse has been detected. The company stated it takes the incident seriously and will implement regular security audits to prevent recurrence.
Police officials warned that the perceived anonymity of the internet can create a false sense of impunity, noting that such actions carry serious legal consequences regardless of the perpetrator’s age.
Related articles
Hacktivist Group Cyberleek Leaks Alleged GTA VI Gameplay and Map Details in Protest Against Digital-Only Releases
A hacktivist collective calling itself Cyberleek has released two purported gameplay clips from GTA VI along with images that may depict the full map of Leonida state. The group claims the leak is a protest against Rockstar's decision to sell physical editions that contain only a download code rather than an actual disc. Cyberleek is also demanding an end to digital pre-orders, the practice of selling built-in content as DLC, and mandatory online connectivity for single-player modes. Rockstar and parent company Take-Two have already filed DMCA takedown requests, which some observers view as indirect confirmation of the material's authenticity. The footage reportedly shows basketball mechanics, vehicle customization, trunk-opening animations, a stamina meter, and an honor system reminiscent of Red Dead Redemption 2. The alleged map includes five counties, an extensive rail network, and numerous small islands. At the same time, Cyberleek is promoting a Solana-based token and soliciting donations, prompting several outlets to question whether the operation is partly a cryptocurrency marketing scheme.
Russian Medical Data Leaks Explode in July: 88 Million Records Exposed
In July 2026 more than 100 million records containing personal data of Russian citizens appeared in open access. Experts from Perspektivny Monitoring recorded 17 separate leaks originating from commercial organizations, online platforms, government bodies, e-commerce stores and medical institutions. The medical sector accounted for the overwhelming majority with 88.37 million records leaked, a sharp increase from 1.7 million in June. Two major incidents, one involving a large medical information system, drove the spike. Head of cyber threat research Nikolay Galkin stated that medical data has now leaked for four consecutive months and that attackers are deliberately targeting highly sensitive information. Other sectors also suffered losses, with 11.12 million records from commercial entities, 8.45 million from online platforms, 8.36 million from government organizations and 2.1 million from internet shops. Stolen databases are routinely traded in messenger channels and dark web marketplaces for use in fraud schemes.
SplitVPN Data Breach Exposes Personal Information of 865,000 Users
A data breach at the Russian VPN provider SplitVPN, formerly known as NotVPN, has exposed the personal details of approximately 865,000 users. The incident, which occurred in July 2026, involved a 17 GB SQL database containing emails, IP addresses, geolocation data, and partial payment card information. The stolen material was later distributed on a cybercrime forum, revealing 23.4 million user records, 13.6 million devices, and 2.6 million payment entries. Nearly 58 million connection logs spanning June 2025 to 21 July 2026 were also included, contradicting the company’s previous no-logs policy. The exposure is particularly concerning for users relying on the service to evade censorship and surveillance.
Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker discovered an IDOR vulnerability in the official Click to Pray application run by the Pope's Worldwide Prayer Network. The flaw allowed anyone to retrieve full user profiles, including names, emails, countries, and birth dates, by simply incrementing numeric user IDs in API requests. No authorization checks or rate limits were present on the endpoint despite the service holding data for over 719,000 registered accounts. The researcher reported the issue to nine contacts in January 2026 but received no response for seven months. Dark Reading independently verified the exposure before publication, after which the endpoint was quickly restricted. The same service had suffered similar authorization failures in 2019 involving PIN code exposure through its eRosary application. The case highlights persistent gaps in object-level authorization and responsible disclosure channels at the Vatican-backed platform.