SEGA newsletter data breach exposes 2.2 million email addresses

Bill Toulas

November 9, 2026
05:09 PM
0

Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers.

The company says the exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services.

The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords.

Also, email addresses registered with a “SEGA Account” are handled by a separate distribution system and were not affected by this incident.

The company is working with ARARA to determine what data was exposed and says it has no confirmed evidence of misuse.

“We are currently investigating the information associated with newsletter distribution in cooperation with ARARA,” SEGA stated.

ARARA service breached

ARARA disclosed on November 2 that it suffered a massive breach affecting its email distribution service, which compromised 77 million email addresses from nearly 380 corporate clients.

According to the company, a web server vulnerability and problems in its system environment contributed to the incident, but the exact intrusion method and timing remain under investigation.

ARARA previously estimated a smaller impact and assured SEGA on October 29 that no data compromise had occurred.

However, on November 3, after uncovering the full extent of the incident, ARARA notified the gaming company that data had been exposed and shared the full details between November 5 and 8.

ARARA also said the attackers abused their access to its service to send over 7 million emails impersonating credit card companies in late October.

Other notable victims of the same incident include MOS Burger, with 7.5 million email addresses exposed, Shochiku Multiplex Theatres, with 3.3 million records, TKC, with 2.3 million email addresses, and IIJmio, with nearly 1 million email addresses.

SEGA Arcade still down

SEGA Fave’s arcade game network services, which suffered a separate cybersecurity incident last week, are still offline, undergoing maintenance and safety checks.

On November 2, SEGA FAVE, SEGA's subsidiary responsible for toys, electronic gadgets, and arcade machine operations, disclosed unauthorized access to servers supporting its ALL.Net and Aime arcade gaming network services.

In response, it suspended all related services, including online gameplay, SEGA Lucky Kuji Online, and new SEGA ID registrations.

Its initial investigation found no evidence of customer or business partner data exfiltration, while payment information was unaffected because it was stored separately.

SEGA noted that the two incidents are unrelated.