Science & Tech · Cybersecurity · 1 hr ago
Sega Says Vendor Breach Exposed 2.2 Million Customer Email Addresses
A breach at email provider Arara exposed about 2.2 million Sega newsletter addresses used to send newsletters to customers.
Arara is a Japanese company that handles email distribution for Sega, and an unauthorized party accessed its systems.
The leaked information was limited to email addresses and 92,273 distribution-related items, according to Sega.
It did not include names, contact details, payment card information or login passwords, and no misuse of the data has been confirmed.
Sega is warning customers to watch for suspicious emails pretending to come from Sega or Sega Fave, and not to open unfamiliar links or attachments.
Arara’s email distribution service remains offline while the company investigates the access and works to prevent further damage.
SEGA said about 2.2 million customer email addresses were exposed after an unauthorized party accessed its email delivery provider, Arara Inc.
The leaked information covered 2.196 million newsletter email addresses and 92,273 distribution-related items.
SEGA said the exposed information did not include names, contact details, payment information or login passwords.
No misuse of the leaked data had been confirmed, but SEGA urged customers to be cautious of suspicious emails.
Arara said the incident involved vulnerabilities in its web servers, and its Arara Message service was suspended.
- Who
- SEGA customers who subscribed to various email newsletters.
- What
- Email addresses and 92,273 distribution-related items were exposed in a third-party incident.
- When
- SEGA disclosed the incident on November 9, 2026. The unauthorized access to Arara’s servers occurred on October 28.
- Where
- Arara Inc., a Japanese email delivery provider used by SEGA.
- Why
- An unauthorized party accessed Arara’s systems after exploiting vulnerabilities in web servers.
This story does not have two clearly opposing sides.
An unauthorized party gained access to certain Arara email distribution service servers by exploiting web server vulnerabilities.
Arara issued a statement saying its systems had been compromised.
Arara suspended its Arara Message distribution service.
Arara’s parent company, Paycloud Holdings, said information held by around 380 corporate clients had been exposed.
SEGA disclosed that customer newsletter email addresses had been exposed through the incident.
- Affected newsletter addresses
- 2.196 million
- Distribution-related items
- 92,273
- Provider
- Arara Inc., a Japanese email delivery provider
- Corporate clients affected across Arara’s service
- Around 380
- Other exposed email addresses reported by Paycloud
- 77 million
3 sources
What people are saying
We deeply apologize for the great inconvenience and concern caused to our customers and all parties involved.
Currently, Arara is working to identify the causes of unauthorized access and prevent further damage, and we are working with Arara and related companies to confirm the details of the leaked information.
Neither our company nor Sega Fave will ask you for your password or credit card information by email.