Bandai Namco’s anime streaming service experienced a mass cancellation of over 46,000 user accounts following a cyberattack that utilized an AI-Generated script.
Per Kyodo News, a 15-year-old male high school student from Saitama Prefecture in Japan utilized a ChatGPT-assisted program to mass-delete 46,812 user accounts from Bandai Channel, the anime streaming platform owned by Bandai Namco Filmworks. The attack occurred on Nov. 4, 2025, between 5 p.m. and 8:46 p.m., when the suspect transmitted false information from his personal computer to Bandai-managed servers.
The cyberattack compromised a portion of the platform’s active user base, which hosts a large library of anime and tokusatsu titles. This forced Bandai Namco Filmworks (previously Sunrise) to suspend Bandai Channel’s operations on Nov. 6, 2025, to perform a network assessment. The site remained shut for over a month before fully resuming on Dec. 19, 2025.
15-Year-Old Utilizes ChatGPT to Delete 46000 Anime Streaming Accounts
At the time, Bandai had reported the attack to the cybercrime countermeasures division of the Metropolitan Police Department (MPD), which then traced the suspect by looking into communication records and server data. The student was initially apprehended on June 13, 2026, on suspicion of violating the Unauthorized Computer Access Prohibition Act by accessing 15 separate user profiles on the platform using fraudulently obtained credentials.
The MPD then finalized the arrest on July 4, 2026, after securing evidence that the boy generated and executed the unauthorized code. The suspect admitted to the allegations during questioning but clarified that his actions were not born out of a grudge towards the company. “I started using computers when I was in the fourth grade and taught myself everything I know. I happened to be able to access the information and had nothing against the company,” he noted. He is being held on charges of fraudulent obstruction of business.
According to the investigators, the student, who was then in the third year of junior high school, identified a system vulnerability by monitoring and analyzing network traffic to and from Bandai Channel’s servers. He subsequently utilized ChatGPT to generate an automated script designed to cancel user subscriptions. When Bandai Namco Filmworks noticed the initial wave of anomalies, they attempted to block his connection. The teen bypassed their defenses by changing his IP address approximately 30 times to keep the script running.
Following the attack, Bandai confirmed that up to 1.36 million items of personal user information, including email addresses, user nicknames and payment methods, were compromised. The company stressed that user passwords and credit card details were not exposed in the breach. Nevertheless, the ease with which a minor compromised the platform led users to criticize Bandai Channel’s cybersecurity infrastructure.
This is not the first time that Bandai Namco has been the victim of a major cybersecurity attack. In July 2022, the company confirmed it had experienced a ransomware attack targeting several group companies in its Asian regions outsideJapan. The cybercriminal group ALPHV, also known as BlackCat, claimed responsibility for the breach and threatened to leak confidential customer information related to the company’s business.
Earlier this year, Crunchyroll was likewise hit by a data breach, during which more than 100 GB of user data was exfiltrated by a threat actor.
