15-Year-Old Boy Arrested in Bandai Channel Unauthorized Cancellation Case

2026-07-06

Unauthorized Access and Account Cancellations

The Tokyo Metropolitan Police Department's cybercrime unit said by the 6th that it had arrested a first-year high school boy, 15, from Tokorozawa, Saitama Prefecture, on suspicion of fraudulent obstruction of business after he repeatedly accessed Bandai Channel, a video streaming service run by a unit of Bandai Namco Holdings, and unlawfully forced about 40,000 members to cancel their accounts. At the time of the incident, he was a 14-year-old junior high school student.

The arrest warrant alleges that on Nov. 4, 2025, he sent false information to the operator's server, using unauthorized access, to cancel the registrations of about 46,800 members, obstructing the company's business by forcing it to suspend the service temporarily. In Nov. 2025, the operator announced that it had experienced an issue in which members were inadvertently logged out and that personal information may have leaked through unauthorized access, and it suspended the service for more than one month.

Illegal Program Completed With Generative AI

The boy is believed to have analyzed server communication data to find vulnerabilities, illegally obtained members' email addresses and registered names, and used a program that automatically carried out cancellation procedures. He is said to have taught himself programming and built the tool on his own, but used the conversational generative AI system ChatGPT to complete the process.

According to the Tokyo police, the boy said, 'I enjoyed analyzing communication contents,' and 'I had no grudge against the operator, but I did it because there was an account that could be canceled. My homemade program took a long time to process, so I asked ChatGPT and finished it.' No secondary leakage or misuse of member information has been confirmed.

Young Suspects Stand Out

After receiving a consultation, Tokyo police investigated and arrested the boy in June on suspicion of violating the Unauthorized Access Prevention Law, saying there was suspicion he had carried out unauthorized operations by exploiting server vulnerabilities. He had also joined a chat tool group with several boys previously arrested in cyberattack cases.

The number of unauthorized access cases is rising. Police nationwide recognized 7,190 cases in 2025, up 1,832 from the previous year and 4.7 times the 1,516 cases in 2021. Incidents targeting online shopping sites and corporate servers using generative AI are also occurring one after another.

According to the National Police Agency, of the 248 people cracked down on in 2025 for violations of the Unauthorized Access Prevention Law, 81 were in their teens, accounting for 32%, and including people in their 20s, the figure reached about 70%. While people in their teens and 20s account for only about 30% of arrests in ordinary criminal cases, their involvement stands out in cybercrime.

A senior police official said, 'It is not unusual to see junior and senior high school students who have been exposed to programming from an early age and possess advanced technical skills. There are also cases in which they use generative AI out of curiosity to create illegal programs and easily commit crimes.' The most common method in unauthorized access cases cracked down on in 2025 was exploiting weak password setting and management.

Makoto Tanase, former head of the National Police Agency's cyber investigations division, said, 'With the spread of generative AI, similar incidents will inevitably increase. Regardless of who the actor is, it is essential to recognize that the environment makes attacks easy, improve system security, and take measures to prevent damage after intrusion.'

Enjoyed this article? Share it with your network!