Teen Arrested for ChatGPT-Assisted Cyberattack on Bandai Channel
A 15-year-old in Japan was arrested for using a ChatGPT-assisted tool to systematically cancel nearly 47,000 user registrations on the Bandai Channel streaming service, forcing a temporary service outage.
Japanese police have apprehended a 15-year-old high school student in connection with a significant cyberattack against Bandai Channel, a popular anime and tokusatsu streaming platform operated by Bandai Namco Filmworks. The teenager is suspected of using a custom-built program, enhanced by OpenAI's ChatGPT, to gain unauthorized access to the service's backend servers. His alleged actions led to the systematic cancellation of registrations for 46,812 members, a disruption so severe that Bandai Namco Filmworks was compelled to temporarily suspend all platform services for its entire user base.
The suspect, who reportedly began learning programming independently around the age of ten, is accused of weaponizing generative AI to automate the process of account abuse. This incident underscores a growing trend where threat actors, including those with less formal cybersecurity training, leverage AI tools to lower the technical barrier for developing sophisticated exploitation scripts. Beyond mass account cancellations, the attacker also reportedly harvested member information, including email addresses and nicknames. While Bandai Namco Filmworks has stated there is no confirmed evidence of this data being leaked publicly or used for secondary fraud, the exposure of personal information in such a large-scale breach remains a concern.
Bandai Namco Filmworks confirmed that the platform services were suspended in November 2025 and resumed in December 2025 after the implementation of enhanced security measures. In a statement, the company committed to strengthening its information security management framework to prevent recurrence, assuring members that they would strive to ensure peace of mind. During police questioning, the arrested individual reportedly admitted to the charges, stating he had no specific grudge against the victim companies. This suggests the attack may have been motivated by technical curiosity or a desire to demonstrate capability rather than financial gain or targeted malice.
This case highlights two escalating concerns within the cybersecurity landscape: the increasing accessibility of generative AI for crafting malicious tools and the vulnerability of streaming platforms to large-scale account takeover and abuse. Security teams managing member-based platforms are advised to treat mass unauthorized account deletion or credential abuse as a critical business continuity risk, not solely a data privacy issue, as it can lead to complete service outages even without confirmed data exfiltration.
Organizations operating such platforms should conduct thorough audits of their authentication mechanisms, paying close attention to rate-limiting protocols. Monitoring for anomalous bulk account actions, such as mass deletions or credential stuffing attempts, is crucial. Furthermore, implementing behavioral detection systems can help identify automated deletion requests, especially as AI-assisted tooling continues to lower the skill threshold for executing such attacks. The incident serves as a stark reminder of the evolving threat landscape and the need for proactive, adaptive security strategies.