TorrentFreak first reported the suit, and the Northern District of California’s public new-case filings confirm that Denuvo filed the complaint, a corporate-disclosure statement, and a proposed summons on September 14. The court record does not yet show a named human defendant, an answer, an order, or any public ruling. At this stage, the central fact is a complaint: Denuvo’s allegations have not been tested in court.
For Windows PC players and administrators, the practical significance is narrower than the rhetoric around piracy might suggest. Denuvo is not suing an ordinary player for running software; it is alleging deliberate reverse engineering and circumvention of access controls at scale. But the lawsuit could determine whether a DRM vendor can use the DMCA to pursue an anonymous person accused of defeating protections deployed across games it does not itself publish or own.
The case is built around DMCA circumvention, not ownership of the games
The complaint, as described by TorrentFreak and Tom’s Hardware, relies on the DMCA’s anti-circumvention provisions rather than conventional claims that voices38 directly infringed the copyrights in Hogwarts Legacy, Black Myth: Wukong, Doom: The Dark Ages, Resident Evil Requiem, and the other games listed. That legal choice matters.
Denuvo licenses its Anti-Tamper technology to game publishers. It is not ordinarily the copyright owner of the protected game itself. A traditional infringement case would therefore place Denuvo in an awkward position unless the relevant publishers joined the litigation or transferred enforcement rights. Section 1201 of the DMCA, however, prohibits bypassing a technological measure that effectively controls access to copyrighted works, while Section 1203 permits a civil action by a person injured by a violation.
That does not automatically settle Denuvo’s standing or prove that every alleged bypass violated the statute. The company will still need to establish facts about its technology, the alleged conduct, and the connection between the defendant and the named accounts. But the anti-circumvention route lets Denuvo frame the claimed injury around defeat of its own protection product, rather than claim ownership of the underlying games.
The distinction also undercuts a casual assumption often made in DRM debates: that a lawsuit must first prove somebody distributed a pirated copy. Under Section 1201, the act of defeating a qualifying access control can itself be the disputed conduct. Distribution, public release, and alleged tools or instructions could become important evidence, but they are not interchangeable legal concepts.
Twenty-six titles do not translate automatically into a damages total
Denuvo is seeking monetary relief, but neither the early public docket nor the reporting establishes a final number. The DMCA allows a successful civil plaintiff to seek actual damages and attributable profits, or to elect statutory damages generally ranging from $200 to $2,500 for each violation of Section 1201. Courts can also issue injunctions, award costs and attorney fees at their discretion, and order modification or destruction of circumvention-related devices or products under certain circumstances.
The number “26 games” is consequently important, but it should not be read as a simple damages calculator. A court would have to decide what constitutes a legally distinct act or violation, which allegations are proven, and whether statutory damages are appropriate. Twenty-six named works could support a substantial claim, yet the statute does not impose a fixed per-game fine.
Denuvo’s request for an injunction may be more consequential than the damages demand. Money matters only if the defendant can be found and a judgment can be collected. An enforceable court order, combined with discovery that identifies accounts, hosts, repositories, payment channels, or collaborators, could be used to remove infrastructure and deter future publication.
That is also why filing an action against “voices38” is not the same as resolving it. An online handle is not automatically a defendant whom a court can serve, depose, or bind. The lawsuit names an unknown individual or entity and additional Doe defendants, according to TorrentFreak. Denuvo will need to connect its allegations to a real-world person or organization before the case can proceed in the ordinary way.
The public record shows a lawsuit, but not an identification strategy
Denuvo’s filing reportedly points to Reddit, Discord, and Steam accounts it believes are linked to the cracking activity. Those references may offer a roadmap toward identifying the defendant, but a belief stated in a complaint is not proof of attribution. Account names can be reused, impersonated, shared, or deliberately separated from the people who operate them.
As of September 16, the public docket reflects the opening filings from September 14 and no visible subpoena campaign. That is the missing operational detail in the initial coverage: there is no public record yet showing that Reddit, Discord, Valve, hosting providers, social platforms, or payment services have been ordered to disclose identifying information.
Denuvo could seek early third-party discovery, but it would typically need court approval before using subpoenas to uncover a Doe defendant’s identity. Platforms may also hold limited data, retain it for differing periods, or provide records that point only to another intermediary. An IP address, if one is obtained, can identify an internet account holder rather than the person who operated a particular account.
The complaint’s California venue could reflect alleged online contacts, the locations of relevant platforms, or other jurisdictional theories. None of those questions is resolved merely because the case was accepted for filing. If voices38 is outside the United States, service, jurisdiction, and eventual enforcement become more complicated still.
For readers watching the case as a test of Denuvo’s technical credibility, that means the first courtroom fight may not concern the internal workings of Anti-Tamper at all. It may concern whether Denuvo can identify the correct person without overreaching into third-party account data.
A bypass, a crack, and DRM removal are different technical claims
Coverage of game piracy frequently treats several distinct methods as synonyms. They are not. A bypass may cause a DRM check to accept an unauthorized environment or emulate a condition a protected title expects. A traditional crack may patch executable code or neutralize the protection logic. Full removal generally suggests that the protection code has been stripped or rendered inactive in a more durable way.
Those differences could matter in court because Denuvo must describe what allegedly happened to its access-control system. They also matter to legitimate PC users assessing claims that a post-release executable is faster, more stable, or less demanding than the original. A performance comparison between two builds cannot, by itself, prove what Denuvo did to performance; game patches, compiler changes, shader behavior, removed telemetry, and altered configuration defaults can all change results.
Tom’s Hardware and other outlets have reported on a sharp increase in releases attributed to voices38 during 2026, including games where Denuvo protections were reportedly bypassed or removed. Those reports establish the scale of the public claims surrounding the handle, not the identity of the actor or the precise technique used in every case. Denuvo’s lawsuit may eventually force more technical detail into the public record, but the current complaint is an accusation, not a forensic report.
This is a point administrators should recognize from ordinary endpoint security work: attribution based on usernames, forum posts, and correlated profiles can be useful intelligence, but it is not the same thing as verified identity. The gap is especially significant when a plaintiff seeks an injunction against an anonymous party.
The lawsuit’s immediate effect is deterrence, not a restored DRM barrier
Denuvo’s suit comes after a period in which the company’s Anti-Tamper product has faced conspicuous public challenges from accounts associated with game cracking. A civil action can raise the cost and risk of public release, particularly if it results in account records, a settlement, or a default judgment. It cannot by itself restore protection to games already bypassed, remove files already mirrored, or guarantee that another researcher will not find a different method.
The company also has not publicly shown, in the available court record, that a publisher whose game appears among the 26 titles joined this action. That leaves Denuvo carrying the case as the DRM supplier whose own technical measure was allegedly circumvented. It is a strategically coherent use of the DMCA, but its success will depend on facts still absent from the public record: who voices38 is, what that person actually did, where it occurred, and whether the alleged measures qualify for the statute’s protections.
The next concrete milestone is not another list of cracked games. It is whether Denuvo obtains discovery that converts “voices38” from an online handle into a defendant who can be served—and whether the evidence survives scrutiny once someone is there to contest it.