Teen Arrested for Bandai Channel Cyberattack Aided by ChatGPT

Key Takeaways

• A 15-year-old student has been apprehended for a cyberattack on Bandai Channel, a streaming service.
• The attack, which leveraged a ChatGPT-assisted program, led to the unauthorized cancellation of nearly 47,000 member accounts.
• Bandai Namco Filmworks, the operator, was forced to temporarily suspend all services due to the disruption.
• While member information was accessed, there is no confirmed evidence of public data leakage or secondary fraud.

Japanese authorities have arrested a 15-year-old high school student from Tokorozawa City, Saitama Prefecture, in connection with a cyberattack that severely disrupted Bandai Channel. The popular anime and tokusatsu streaming service, operated by Bandai Namco Filmworks, suffered widespread service interruptions after the teenager allegedly used a program developed with the assistance of ChatGPT to carry out the attack.

The student faces charges of fraudulent obstruction of business following an investigation into the incident, which occurred when he was still in his third year of junior high school in November 2025.

Widespread Account Cancellations Force Service Suspension

Investigators report that the suspect gained unauthorized access to Bandai Channel’s backend infrastructure. From there, he systematically initiated the cancellation of 46,812 member registrations, resulting in a mass withdrawal of user accounts. The scale of the disruption was significant enough to compel Bandai Namco Filmworks to temporarily halt all platform services, effectively cutting off access for its entire user base while the company addressed the breach and investigated its extent.

ChatGPT-Assisted Exploitation Tool

Police indicate that the suspect developed a custom program, utilizing OpenAI’s ChatGPT, to automate the unauthorized access to member accounts and execute account deletions at scale. This incident underscores a growing trend where threat actors, even those with limited formal training and self-taught skills, are increasingly leveraging generative AI to reduce the technical barriers associated with developing sophisticated exploitation scripts.

The boy reportedly began self-learning programming around fourth grade, accumulating sufficient expertise to weaponize AI-assisted code generation for repeated, automated attacks against live production systems, according to a Japanese news Website.

During the intrusions, the attacker also managed to harvest member information, including email addresses and nicknames. Bandai Namco Filmworks has publicly stated that, as of now, there is no confirmed evidence that this data was publicly leaked or exploited for secondary fraudulent activities. Nevertheless, the exposure of Personally Identifiable Information (PII) on such a large scale remains a significant concern for the affected users.

A timeline of events includes:

• November 2025: Bandai Namco Filmworks suspends all Bandai Channel services after detecting unauthorized access and unintended removals of member accounts.
• December 2025: Services resume following the implementation of enhanced security measures.
• Company statement: No confirmed public disclosure of personal data or secondary damage reported.
• Ongoing: Bandai Namco Filmworks commits to strengthening its information security management framework to prevent recurrence.

In a statement issued to press inquiries, the company affirmed its commitment: “We will strive to prevent recurrence by further strengthening our security management system, including information security management, so that our members can use our services with peace of mind.”

During questioning, the teenager reportedly admitted to the charges. He informed investigators that he “had no grudge against the victim companies,” suggesting the attack might have been driven by technical curiosity or a desire to demonstrate capability, rather than financial gain or malicious intent.

This incident highlights two intensifying concerns within the current cybersecurity landscape: the increasing accessibility of generative AI tools for crafting exploitation scripts and the vulnerability of streaming platforms to large-scale account-takeover-style attacks.

Security teams should recognize mass unauthorized account deletion or credential abuse not solely as a data privacy issue, but as a critical business continuity risk. Such incidents can lead to full-service outages even in the absence of confirmed data exfiltration.

What You Should Do

• Audit Authentication Rate-Limiting: Implement and regularly review robust rate-limiting controls on authentication endpoints and account modification features to prevent automated abuse.
• Monitor for Anomalous Bulk Actions: Deploy advanced monitoring systems to detect and alert on unusual patterns of bulk account actions, such as mass deletions, password resets, or profile changes.
• Consider Behavioral Detection: Utilize behavioral analytics to identify automated deletion requests or other suspicious activities that deviate from typical user behavior.
• Educate Users: Promote strong password practices and multi-factor authentication (MFA) to enhance individual account security.
• Review AI-Assisted Tooling Policies: Organizations should develop internal policies regarding the use of AI-assisted code generation tools, recognizing their potential to lower the skill barrier for malicious actors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.