On 26 March 2026 the Alliance for Creativity and Entertainment (ACE), the anti-piracy coalition led by the Motion Picture Association, announced it had shut down AnimePlay, an illegal anime streaming app run from Indonesia with more than five million registered users. This isn't a security incident and the direct impact on developers is small. What stands out is how the takedown worked: the operator gave up his source code repositories, servers and domains instead of the service just being blocked.
What happened
According to ACE, AnimePlay was run from Riau, Indonesia, and was one of the largest illegal anime streaming apps in the Asia-Pacific region. It launched in 2020, hosted more than 60 TB of infringing anime series and films, and had more than five million registered users, mostly in Indonesia.
ACE says one man admitted to being the app's developer and sole administrator since launch and surrendered its entire backend, including:
- 29 GitHub repositories containing the full source code;
- backend servers and their databases;
- built-in advertising tools; and
- 15 associated domains, the hosting environment and related digital assets.
ACE says all of these are now offline, making a relaunch harder. A corrected release on 27 March described it as the first successful APK-focused shutdown in Indonesia. Piracy Monitor noted that at announcement time the app was still listed on Google Play and several APK download sites. ACE didn't name the operator or any law enforcement partner.
The action follows other ACE shutdowns, including Photocall in November 2025, a Spanish-hosted site run with DAZN that had more than 26 million visits in a year and carried 1,127 TV channels from 60 countries.
Who is affected
- AnimePlay's users, who lose the service. Sideloaded copies of the APK may stop working once the backend is gone, and any copies still circulating should be treated as untrusted.
- Rights holders in the anime industry, whose content was being redistributed.
- There's no impact on legitimate software or services.
What it means for developers and engineering teams
For most developers the lesson is small but real. Piracy operations are built from the same parts as legitimate apps: code on GitHub, cloud servers, ad SDKs and domain registrars. That's why enforcement now targets those parts directly, through repository handovers, domain transfers and hosting takedowns, rather than only blocking a website. If you build or host apps, the people you rely on (code hosts, registrars, app stores) respond to rights-holder pressure. Running a service on infringing content puts your whole stack at risk, not just the content.
For users and IT teams, unofficial streaming APKs are also a common way malware gets onto phones, since they're installed outside app-store review and often come with aggressive ad code. When an app like this disappears, copycat "replacement" APKs usually appear soon after.
What to do now
- Uninstall abandoned piracy APKs and don't install "replacement" versions from unofficial sites.
- Block sideloading on company-managed Android devices through your MDM policy.
- If you run a content or streaming platform, have a documented takedown and repeat-infringer process, and check the third-party ad SDKs you bundle.
Sources
- ACE corrected press release via PR Newswire Asia (27 March 2026)
- Piracy Monitor: App with 5 million registered users hosted over 60 TB of infringing content
- BleepingComputer: Anti-piracy coalition takes down AnimePlay app with 5 million users
- Advanced Television: Photocall shuttered following action by ACE, DAZN