---
title: "DIRECT GAMES member-data incident"
description: "H2INT confirmed unauthorized access exposed DIRECT GAMES member information, including protected passwords and order histories."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-28"
canonical_url: "https://www.ally.security/incidents/direct-games-member-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/direct-games-member-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/direct-games-member-data-incident-2026/stix.json"
---

# DIRECT GAMES member-data incident

The operator disclosed an October 17–18 intrusion and required password resets while investigating the entry route.

Last modified Oct 28, 2026 · 1 source

## Summary

- **Environment:** DIRECT GAMES member information
- **Operational impact:** Member data leaked; password resets required
- **Financial impact:** No financial loss established; card numbers excluded

## What happened

[H2INT](https://www.h2int.jp/) confirmed that unauthorized access to its DIRECT GAMES store on October 17–18, 2026 exposed member information. It established the leak on October 18 and published its [notice](https://www.h2int.jp/news/news_view.html?idx=456) on October 28. [1](#source-1)

## Impact

The notice lists email-based member IDs, encrypted login passwords, names, birth dates and order histories. Names and birth dates were optional inputs. H2INT did not disclose an affected-member count or its password-protection method. It said card numbers were not held and were excluded, and no secondary misuse had been confirmed. [1](#source-1)

## Timeline

### October 17, 2026 — Access window begins

The reported two-day access window begins. [1](#source-1)

### October 18, 2026 — Leak established

The operator confirmed the exposure. [1](#source-1)

### October 28, 2026 — Public notice issued

H2INT published its findings and response. [1](#source-1)

### October 28, 2026 — Briefing updated

This briefing was last reviewed and updated on October 28, 2026.

## Threat Group & Attack Vector

The entry route remained under investigation. Describing passwords as encrypted does not establish their resistance to recovery. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

H2INT blocked the unauthorized communications, improved the system, established a response team and reported to Japan's privacy regulator. All members were instructed to reset passwords. External investigation, permanent controls and individual notifications continued; a universal reset instruction does not mean every member's information was stolen. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/direct-games-member-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 不正アクセスによる会員情報漏えいに関するお詫びとお知らせ

official · H2INT Co., Ltd. · Oct 28, 2026

<https://www.h2int.jp/news/news_view.html?idx=456>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: Public member notice issued
2. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: Member information leak confirmed
3. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: Unauthorized-access window begins
4. **Affected Organization · 100% confidence · current**  
   DIRECT GAMES member-data breach: H2INT Co., Ltd.
5. **Occurred At · 100% confidence · current**  
   Member information leak confirmed: 2026-10-18
6. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: H2INT confirmed that unauthorized access to DIRECT GAMES on October 17–18, 2026 leaked member information; the company established the leak on October 18.
7. **Occurred At · 100% confidence · current**  
   Public member notice issued: 2026-10-28
8. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: Leaked fields included member IDs (email addresses), encrypted login passwords, names, dates of birth and order histories. Names and dates of birth were optional inputs that might not match real identity.
9. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: H2INT blocked the unauthorized communications, made system improvements, established a response headquarters, reported to the Personal Information Protection Commission and advised all members to reset passwords.
10. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: The entry mechanism and detailed cause remained under investigation; H2INT planned external-specialist assistance, permanent controls and individual notices.
11. **Resulted In · 100% confidence · current**  
   DIRECT GAMES member-data breach: H2INT said it did not hold credit-card numbers and they were not leaked. It reported no confirmed secondary misuse at the time of its notice.
12. **Occurred At · 100% confidence · current**  
   Unauthorized-access window begins: 2026-10-17
13. **Disclosed At · 100% confidence · current**  
   DIRECT GAMES member-data breach: 2026-10-28
14. **Discovered At · 100% confidence · current**  
   DIRECT GAMES member-data breach: 2026-10-18

</details>