Japanese Police Arrest 15yo Over ChatGPT-Assisted Cyberattack Against Bandai Channel

Tokyo Metropolitan Police have arrested a 15-year-old high school student on suspicion of fraudulent obstruction of business over a November 2025 cyberattack on Bandai Channel, the anime and tokusatsu streaming service operated by Bandai Namco Filmworks, according to reports from TBS News and The Record.

The suspect, a first-year high school student from Tokorozawa City in Saitama Prefecture, was in his third year of junior high school at the time of the attack. According to police, he identified a vulnerability in the platform by analyzing its network traffic, then used ChatGPT to help write a program that automated unauthorized access to member accounts. That program allegedly triggered the cancellation of 46,812 member registrations, forcibly unsubscribing users at scale.

The fallout was severe. Bandai Namco Filmworks took the entire service offline on November 6, 2025, two days after it detected members being unintentionally removed from the platform, and did not restore it until December 19, 2025. In its resumption notice, the company said an investigation with an external expert organization found that data on up to 1.366 million members may have been leaked, including email addresses, nicknames, Bandai Namco Coin balances, and each member's selected payment method.

The company stressed that the exposed data did not include login passwords or credit card numbers, and that it has found no evidence of the information being published online or misused. It also confirmed the incident was not a ransomware attack, warned members to watch for phishing and impersonation emails, and said it contacted all affected users individually, including those who had already left the service. A final report was submitted to Japan's Personal Information Protection Commission, and the company is refunding fees charged during the suspension. Members whose accounts were forcibly canceled must re-register.

Police say the investigation traced back to an earlier case. The teenager was first arrested in June on suspicion of logging into the platform using another user's account and viewing member information. That inquiry led investigators to connect him to the broader November attack.

During questioning, the suspect admitted to the allegations and told police he had "no grudge" against the company. Investigators say he taught himself programming from around the fourth grade of elementary school and enjoyed analyzing network communications.