Teen in Japan Arrested Over Cyberattack on Internet Cafe Operator; Police Suspect ChatGPT Used in Crime

The Yomiuri Shimbun

16:47 JST, December 4, 2025

The Metropolitan Police Department arrested a 17-year-old boy on Thursday on suspicion of launching a cyberattack against the operator of an internet cafe chain.

The second-year high school student from Osaka is suspected of violating the Prohibition of Unauthorized Computer Access Law and obstructing the operations of Kaikatsu Club, a chain of internet cafes where customers can browse the internet, play video games and enjoy various other services in private spaces.

The MPD suspects that the boy obtained information on club members using a program he created by taking advantage of ChatGPT, OpenAI’s AI chatbot.

According to investigative sources, the student allegedly accessed the server for the official app managed by Kaikatsu Frontier Inc., the Yokohama-based operator of Kaikatsu Club, from Jan. 18 to 20, and executed a self-made program to steal information on club members. This attack forced the company to suspend some of the app’s services, thereby obstructing its business.

He is believed to have stolen about 7.25 million pieces of personal information, but it has not yet been confirmed if the information has been misused, according to the sources.

The student allegedly developed the program to extract information on Kaikatsu Club members onto his own device. He is suspected of having turned to ChatGPT to learn how to bypass Kaikatsu Club’s cybersecurity and how to deal with any error messages that would appear while attempting unauthorized access, thus improving his program.

The MPD previously arrested a group of teenage boys for having illegally logged into the Rakuten Mobile, Inc. system and obtain accounts. Investigations into these boys since February led the police to suspect the involvement of the Osaka teenager in the attack on Kaikatsu Club, according to the sources.

The Osaka teen is famous among young people interested in cybercrime, as he shared his plan to attack Kaikatsu Club while livestreaming on Discord, a platform popular among gamers.

The boy had been previously arrested by the MPD on Nov. 15 on suspicion of using the information of a credit card under someone else’s name to fraudulently purchase Pokémon cards via an e-commerce site in May last year.

“I was curious if I could find any vulnerability on the site,” the boy was quoted as saying. “I wanted to study how to commit fraud using credit cards.”

Aoki Holdings Inc., the parent of Kaikatsu Frontier, said in January that over 7.2 million pieces of personal information — such as the names, addresses and phone numbers of members of Kaikatsu Club and a fitness club chain that the group company also operates — might have been leaked.

Generative AI chatbots provided by OpenAI and other tech giants contain guardrails – safeguards that are designed to not provide answers that could be misused for criminal purposes. When asking questions to ChatGPT, however, it is suspected that the boy avoided expressions that would be caught by the guardrails but still providing the information he needed, according to the sources.

The student has been developing his programming skills through self-study since elementary school. He has earned a prize at a contest on cybersecurity skills, according to the sources.