SEGA said on November 9 that 2,196,044 email addresses used for its newsletters leaked after an unauthorized party broke into the systems of its email delivery vendor, Arara. The company says names, birth dates, addresses, phone numbers, card details and passwords were not part of the leak, but the exposed addresses make targeted phishing more likely.
What happened
SEGA and its group company SEGA FAVE send some product newsletters through Arara’s “Arara Message” mailing service. In its announcement, SEGA says a third party gained unauthorized access to Arara’s system and the addresses used for those mailings leaked. The total is 2,196,044 addresses. A subset of 92,273 records also carries “information accompanying the distribution”; SEGA says it is still working out with Arara what that information is.
The affected mailings are 11 newsletters sent between July 2 and October 28, 2026, covering items such as SEGA Lucky Kuji lottery sales, Tokyo Game Show 2026 exhibit information and arcade game launch notices. Addresses registered only to a SEGA Account are not affected, because that service uses a different delivery system.
According to SEGA’s timeline, it asked Arara to check its newsletter delivery on October 29 and was told no leak had been confirmed. Arara publicly disclosed unauthorized access on November 1, and on November 3 told SEGA that the addresses used for SEGA’s mailings had leaked. After further checks and a formal report from Arara, SEGA announced the incident on November 9. It has suspended newsletters sent through Arara.
Why it matters
SEGA is one of many Arara clients. Jiji Press reported on November 2 that about 77 million email addresses were affected across the service, with up to about 380 client companies having information compromised, and that Arara’s parent, Paycloud Holdings, confirmed up to about 7.13 million suspicious emails impersonating a credit card company sent after the intrusion. Those figures come from one wire report and describe Arara’s overall incident, not SEGA’s share.
SEGA describes this as separate from an intrusion into the server of SEGA FAVE’s arcade network service, which has kept SEGA Lucky Kuji Online in maintenance.
What to do
- Be wary of email claiming to be from SEGA, SEGA FAVE or Arara. SEGA says it never asks for passwords or card details by email.
- Do not open links or attachments in unexpected messages, and do not reply to them.
- Our analysis: if you subscribed to SEGA newsletters, treat any message about prizes, lottery orders or account problems as suspect and go to the official site directly instead.
- Our analysis: use a unique address or alias for marketing mailings where you can, and enable multi-factor authentication on accounts tied to the same address.
What we still do not know
SEGA has not said what the extra information on the 92,273 records contains, how the attackers got into Arara, or when it will resume newsletters through the vendor. It says no misuse has been confirmed so far. The figures are records, not people, so the number of individuals is not established. SEGA plans to file a joint report with Japan’s Personal Information Protection Commission and to notify affected customers once details are confirmed; it has not said the report was filed.
Sources: SEGA announcement (Nov. 9, 2026); CyberInsider (Nov. 9, 2026); Jiji Press via Nippon.com (Nov. 2, 2026).
Leave a Reply