Sega newsletter data breach sees 2.2 million email addresses exposed

• Sega disclosed a third-party breach that exposed nearly 2.2 million customer email addresses through a marketing service provider
• Around 92,000 additional records related to email distribution were also compromised in the incident
• Sega and its provider warned users about phishing risks, though no misuse of the leaked data has been confirmed

Gaming giant Sega has disclosed suffering a third-party cybersecurity incident that exposed email addresses of almost 2.2 million people, as well as other details of at least 92,000.

The company is now investigating deeper, to confirm the details of the leaked information.

What happened

Sega is one of many Japanese companies using the services of Arara, a technology firm providing digital marketing and customer engagement services.

One of its services is called Arara Message, an email distribution platform that businesses can use to send newsletters and other communications to millions of people. This also means Arara was managing contact information on behalf of those organizations, including email addresses, names, and often phone numbers and membership details.

In early November 2026, Arara reported its email distribution infrastructure suffering a compromise. Apparently, a combination of a web server vulnerability and “other system weaknesses” allowed unidentified threat actors to access 97 servers that stored data of up to 380 corporate customers.

The attackers accessed (and most likely exfiltrated) more than 81 million email addresses, together with people’s names, dates of birth, phone numbers, postal addresses, and membership numbers. Not every customer had all of this data exposed – it varied from person to person.

In a subsequent report, Arara added that the attackers compromised a separate environment containing additional 3.38 million email addresses and more than 400,000 customer records containing PII. They ended up sending more than seven million phishing emails spoofing various credit card companies, forcing the company to temporarily shut down the service on October 31 2026.

Many large organizations had their newsletter contacts exposed. Asoview reported approximately 15.82 million records, while electronics retailer Bic Camera reported 15.2 million. Fast-food chain MOS Burger disclosed the exposure of some 7.5 million email addresses, while cinema operator Shochiku Multiplex Theaters 3.3 million.

Sega under fire again

Among them were also video game giant Sega and its subsidiary Sega Fave, who disclosed approximately 2.2 million affected email addresses.

“Sega Corporation uses Arara Corporation’s distribution system to distribute certain email newsletters related to products and services of our company and its group company, Sega Fave Corporation. It has recently been discovered that Arara Inc. was subjected to unauthorized access by a third party, and the email addresses of customers used to distribute the email newsletter were leaked externally,” the company said in a short announcement.

The company said that as of November 9, it can confirm 2,196,044 emails as compromised, together with 92,273 other items “related to distribution”.

Information that has not been leaked at this time include customer names, dates of birth, gender, addresses, phone numbers, credit card information, and login passwords.

“At this time, no misuse of the leaked information related to this case has been confirmed,” Sega said. “The email address registered with the “SEGA Account” uses a different distribution system and is therefore excluded from the leaked information.”

This is Sega’s second major cybersecurity incident this month after its Sega Fave arcade game network services were recently brought offline and are, according to BleepingComputer, still unavailable as the company works on maintenance and safety checks.

On November 2, Sega Fave said an unidentified threat actor accessed its servers supporting its ALL.Net and Aime arcade gaming network services but later stressed that these two incidents were unrelated. Online gameplay, Sega Lucky Kuji Online, and new Sega ID registrations, were all brought offline for investigation.

So far, no threat actors claimed responsibility for the breach. Both Sega and Arara warned their users about possible phishing emails and urged them not to click on any links or download attachments from emails claiming to come from the companies.

Via BleepingComputer

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.