17-Year-Old Arrested for Extracting Personal Data of 7 Million Kaikatsu Club Users

On December 4 2025, a 17‑year‑old was arrested in Osaka under Japan’s Unauthorized Access Prohibition Act for running malicious code that extracted personal data from Kaikatsu Club, Japan’s largest internet cafe chain. The hacker stole the personal information of over 7 million users, including names, addresses, and credit card details. The motive behind the attack was to purchase Pokémon cards. The arrest followed a thorough investigation by Japanese law enforcement. The incident underscores the vulnerability of large consumer‑facing platforms to data‑exfiltration attacks. Kaikatsu Club has not yet announced a public data‑breach notification. The case illustrates the legal consequences of unauthorized access in Japan. Businesses should review their data‑protection policies and ensure compliance with local privacy laws.