Teen Arrested in Japan for Hacking Internet Cafe Chain to Buy Pokémon Cards

On December 4, 2025, a 17-year-old individual was arrested in Osaka, Japan, under the Unauthorized Access Prohibition Act for executing malicious code to extract personal data from over 7 million users of Kaikatsu Club, the country’s largest internet cafe chain. The attacker’s stated motivation was to obtain funds for purchasing Pokémon cards. The incident involved unauthorized access to sensitive user information, though no further technical details or specific attack methods were disclosed. No CVE IDs or additional impact assessments were provided in the report.