2026 Bandai Channel — unauthorized subscription cancellations; 46,812 accounts
Data compromised
Unauthorized cancellation of 46,812 subscription accounts; police believe member information including email addresses and usernames was obtained during the incident—misuse not confirmed at initial reporting
Technical writeup
Verified cyber incident — attack window November 4, 2025. Tokyo police arrested a 15-year-old student on July 4, 2026 over an alleged cyberattack targeting Bandai Channel, the anime streaming service operated by Bandai Namco Filmworks. Police allege the suspect used a program created with ChatGPT assistance to send false information exploiting a system vulnerability, causing unauthorized cancellation of 46,812 subscription accounts between roughly 5:00 p.m. and 8:45 p.m. on November 4, 2025. Bandai Namco operations were partially disrupted November 6 and full service resumed in December after repairs. Investigators believe member information including email addresses and usernames was obtained, though confirmed misuse had not been found at initial reporting. The case highlights weak authorization on state-changing account workflows rather than a traditional mass data exfiltration breach.
Root cause
Unauthorized automated requests exploiting a Bandai Channel account-management vulnerability; Tokyo police arrested a 15-year-old suspect July 4, 2026
References
- https://darkwebinformer.com/tokyo-police-arrest-15-year-old-over-alleged-bandai-channel-cyberattack/
- https://www.straitstimes.com/asia/east-asia/japanese-teen-arrested-for-cyberattack-that-unsubscribed-over-46000-anime-accounts
- https://automaton-media.com/en/news/15-year-old-arrested-in-japan-over-alleged-cyberattacks-on-bandai-namco-anime-streaming-service-using-chatgpt-generated-malware/