← Bandai Namco

2026 Bandai Channel — unauthorized subscription cancellations; 46,812 accounts

2026 46.8K records affected Share on X

Data compromised

Unauthorized cancellation of 46,812 subscription accounts; police believe member information including email addresses and usernames was obtained during the incident—misuse not confirmed at initial reporting

Technical writeup

Verified cyber incident — attack window November 4, 2025. Tokyo police arrested a 15-year-old student on July 4, 2026 over an alleged cyberattack targeting Bandai Channel, the anime streaming service operated by Bandai Namco Filmworks. Police allege the suspect used a program created with ChatGPT assistance to send false information exploiting a system vulnerability, causing unauthorized cancellation of 46,812 subscription accounts between roughly 5:00 p.m. and 8:45 p.m. on November 4, 2025. Bandai Namco operations were partially disrupted November 6 and full service resumed in December after repairs. Investigators believe member information including email addresses and usernames was obtained, though confirmed misuse had not been found at initial reporting. The case highlights weak authorization on state-changing account workflows rather than a traditional mass data exfiltration breach.

Root cause

Unauthorized automated requests exploiting a Bandai Channel account-management vulnerability; Tokyo police arrested a 15-year-old suspect July 4, 2026

References