Tokyo police have arrested a 15-year-old high school student suspected of carrying out cyberattacks against a popular anime streaming service.

The unnamed student, who lives in a city near Tokyo, allegedly exploited a flaw in the servers of Bandai Channel, a subscription-based anime streaming platform, to fraudulently cancel more than 46,000 user subscriptions, the Tokyo Metropolitan Police Department said in a statement to local media.

Police said the teenager identified the vulnerability by analyzing the service's network traffic and developed a malicious program using ChatGPT to automate the attacks. He allegedly sent fraudulent data to the company's servers in November 2025, causing thousands of accounts to be canceled and prompting the temporary suspension of the service.

The boy was first arrested in June on suspicion of logging into the platform using another user's account. Police said their subsequent investigation linked him to the broader attack. He admitted to the allegations and told investigators he had no grudge against the company, adding that he had taught himself programming and enjoyed analyzing network communications, according to police.

The service’s operator said at the time that the disruption forced it to suspend the platform for more than a month while it repaired its systems and refunded affected subscribers. 

Police said the company blocked the suspect's access after detecting the attacks, but he continued carrying out unauthorized account cancellations by repeatedly changing his IP address.

The company reported the incident to police in November, and investigators identified the suspect through an analysis of communication records.

The anime streaming service is owned by one of Japan’s largest entertainment companies that publishes some of the world’s best-known video game franchises. In 2022, the parent company disclosed a cyberattack that may have exposed customer information after unauthorized access to systems used by several of its Asian subsidiaries. The incident was later claimed by the AlphV ransomware group.