Incident BriefingsDIRECT GAMES member-data incident

DIRECT GAMES member-data incident

The operator disclosed an October 17–18 intrusion and required password resets while investigating the entry route.

Last modified

Summary

  • Environment: DIRECT GAMES member information
  • Operational impact: Member data leaked; password resets required
  • Financial impact: No financial loss established; card numbers excluded
  • Record status: Developing record. Reviewed October 28, 2026; updated as evidence emerges.

What happened

H2INT confirmed that unauthorized access to its DIRECT GAMES store on October 17–18, 2026 exposed member information. It established the leak on October 18 and published its notice on October 28. [1]

Impact

The notice lists email-based member IDs, encrypted login passwords, names, birth dates and order histories. Names and birth dates were optional inputs. H2INT did not disclose an affected-member count or its password-protection method. It said card numbers were not held and were excluded, and no secondary misuse had been confirmed. [1]

Timeline

  1. Access window begins

    The reported two-day access window begins.

    [1]

  2. Leak established

    The operator confirmed the exposure.

    [1]

  3. Public notice issued

    H2INT published its findings and response.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on October 28, 2026.

Threat Group & Attack Vector

The entry route remained under investigation. Describing passwords as encrypted does not establish their resistance to recovery. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

H2INT blocked the unauthorized communications, improved the system, established a response team and reported to Japan’s privacy regulator. All members were instructed to reset passwords. External investigation, permanent controls and individual notifications continued; a universal reset instruction does not mean every member’s information was stolen. [1]