Japanese teenager detained following disruptive cyberattack on anime streaming platform

Summary

Tokyo police have arrested a high school student suspected of disrupting the Bandad Channel anime streaming service through large-scale unauthorized cancellations. The suspect allegedly identified a vulnerability by analyzing the platform's network traffic and used an AI-generated program to automate the attack.

The disruption resulted in more than 46,000 user subscriptions being canceled in November 2025. This event forced the service operator to suspend its entire platform for over a month to facilitate system repairs and issue refunds to affected subscribers.

What happened

The suspect allegedly bypassed standard access controls by analyzing how the service communicated across its network. After identifying a flaw, he developed a malicious program using ChatGPT to automate the delivery of fraudulent data to the company's servers.

When the service operator detected the activity, they attempted to block the attacker's access. However, the suspect circumvented these blocks by repeatedly changing his IP address to continue the unauthorized cancellations. The investigation began after an initial arrest in June related to a separate incident involving unauthorized login via another user's account. Investigators eventually linked the student to the broader disruption through an analysis of communication records.

Why this matters for defenders

This incident highlights how automated tools can be used to weaponize network traffic analysis. By observing how an application handles requests, an attacker can identify logic flaws that allow them to manipulate account states without traditional authentication bypasses.

The ability of the attacker to evade IP-based blocking by rotating addresses underscores the limitations of relying solely on source IP reputation for mitigation. When a malicious actor automates high-frequency actions-such as subscription cancellations or profile changes-traditional perimeter defenses may fail to stop the volume of requests if they appear distributed.

Defender guidance

To mitigate risks associated with automated account manipulation, organizations should implement the following technical controls:

• Rate Limiting on State Changes: Implement strict rate limits not just on login attempts, but on any action that changes a user's subscription status or account state.
• Behavioral Anomaly Detection: Monitor for sudden spikes in specific API calls or database writes that correspond to account cancellations or deletions.
• Session and Traffic Validation: Ensure that all incoming data packets strictly adhere to expected schemas to prevent the injection of fraudulent data through intercepted network communications.
• IP-Agnostic Mitigation: Move beyond IP-based blocking by implementing more granular controls, such as device fingerprinting or requiring secondary verification for sensitive account changes.