15-Year-Old Saitama Student Uses ChatGPT to Mass-Cancel 46,812 Bandai Channel Subscriptions, Triggering Service Outage and Data Breach Concerns
A 15-year-old student from Saitama Prefecture has been arrested for orchestrating a sophisticated cyber attack that resulted in the mass cancellation of 46,812 user subscriptions on the popular anime streaming service Bandai Channel, operated by Bandai Namco Filmworks.
According to Japanese police, the teenager developed a custom program capable of simulating legitimate user requests to delete accounts. The original code, written while he was still in middle school, processed requests too slowly, prompting the student to consult ChatGPT and rewrite the script in a more efficient programming language.
On November 4, 2025, the optimized program was used to flood the service’s servers with fraudulent deletion commands, causing the platform to automatically terminate tens of thousands of accounts and forcing the company to suspend operations temporarily.
When Bandai Namco Filmworks attempted to block the attacker’s access, the student evaded detection by rotating his IP address more than 30 times, demonstrating that the assault was deliberate and sustained rather than accidental.
Investigators later discovered that the same individual had already come to police attention in June, when he was detained in connection with other computer crimes. During questioning, the teenager stated that he held no grudge against the company and had acted simply to gain access to a large number of user accounts.
Company Response and Data Protection Concerns
Bandai Namco Filmworks filed a formal complaint with the Tokyo Metropolitan Police Department in November 2025. In December, the company publicly acknowledged a possible compromise of personal information belonging to up to 1.36 million accounts, including email addresses, account balances, and payment details.
Despite the scale of the potential exposure, the firm confirmed that no evidence of data publication or secondary misuse has been detected. The company stated it takes the incident seriously and will implement regular security audits to prevent recurrence.
Police officials warned that the perceived anonymity of the internet can create a false sense of impunity, noting that such actions carry serious legal consequences regardless of the perpetrator’s age.
Related articles
Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker discovered an IDOR vulnerability in the official Click to Pray application run by the Pope's Worldwide Prayer Network. The flaw allowed anyone to retrieve full user profiles, including names, emails, countries, and birth dates, by simply incrementing numeric user IDs in API requests. No authorization checks or rate limits were present on the endpoint despite the service holding data for over 719,000 registered accounts. The researcher reported the issue to nine contacts in January 2026 but received no response for seven months. Dark Reading independently verified the exposure before publication, after which the endpoint was quickly restricted. The same service had suffered similar authorization failures in 2019 involving PIN code exposure through its eRosary application. The case highlights persistent gaps in object-level authorization and responsible disclosure channels at the Vatican-backed platform.
Measuring Data Leak Risk by Days of Silence Rather Than Megabytes in Cloud Environments
A financial expert turned security specialist argues that the true cost of data leaks in cloud offices stems not from the volume of exposed files but from the duration they remain undetected. The article details how routine actions such as making documents public, forwarding emails externally, or changing passwords can silently expose sensitive information in platforms like Yandex 360 without triggering any alerts. It warns against blanket prohibitions that push risky behavior into unmonitored channels like personal email or messengers, reducing visibility to zero. Instead, the recommended approach focuses on real-time event-driven notifications combined with automated remediation to minimize the window of exposure. The piece provides a detailed checklist for evaluating monitoring tools, including immediate reaction capabilities, self-healing actions, regular overview reports, and proof of system health. Emphasis is placed on secure integration via OAuth, data residency compliance, and the importance of treating employees as hurried professionals rather than malicious actors.
Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens
The Russian Ministry of Internal Affairs (MVD) has initiated five criminal investigations following the discovery of online platforms that sold personal data of Russian citizens, operating on the same model as the notorious 'Glaz Boga' service. These platforms allowed users to pay for access to detailed biographies and confidential information compiled into multiple files, including passport details, bank account records, and other sensitive personal information. The cases are being investigated under Article 272.1 of the Russian Criminal Code, which addresses the illegal use, transfer, collection, and storage of computer information containing personal data. Authorities have seized the servers of the implicated services and are currently analyzing their contents to gather evidence, although the specific names of the platforms, the number of clients, and the volume of data sold remain undisclosed. The developments highlight how repeated data leaks have transformed personal information into a marketable commodity traded on underground marketplaces, prompting law enforcement action against the operators responsible for distributing such data.
Solar inRights 3.11 Automatically Blocks Corporate Accounts Whose Passwords Appear in Dark Web Leaks
GC Solar has released Solar inRights 3.11, a major update to its identity and access management platform that integrates directly with the Solar AURA threat monitoring service. The new version automatically detects corporate credentials exposed in open sources and dark web dumps, validates whether the same login-password pairs remain active inside the organization, and instantly revokes access while alerting the security team. The feature addresses the common scenario in which employees reuse work email addresses and passwords on third-party websites, allowing attackers to test stolen credentials against corporate systems in what appears to be legitimate login attempts. Research cited by Solar shows that a single large Russian company typically has more than 600 unique corporate accounts circulating in public and underground sources, although only about 4 percent directly indicate infrastructure compromise. Yandex Cloud data further reveals that valid account abuse featured in 54 percent of over 25,000 attacks on cloud and hybrid environments during the first half of 2025. In addition to the leak-response capability, version 3.11 introduces improved search, request filtering, and integration templates for Active Directory, Exchange, and 1C.