SEGA confirms ARARA newsletter breach exposed 2.2 million e-mail addresses

SEGA disclosed on November 9, 2026 that unauthorized access to ARARA Inc.’s email delivery service exposed 2,196,044 newsletter subscriber email addresses.

The exposed data did not include login passwords, credit card details, phone numbers, addresses, gender, dates of birth and customer names, SEGA said. The company also said e-mail addresses registered with SEGA Account were not affected because that service uses a separate distribution system. SEGA said it has no confirmed evidence of misuse of the exposed information. SEGA’s published count reflects e-mail address records rather than a confirmed number of unique individual customers affected.

92,273 of the exposed addresses also included newsletter delivery information, SEGA said, and the company is still determining what that additional data contains. The additional data remains under review. Some reports describe the additional exposed records as 92,300 items pending classification.

SEGA first asked ARARA to verify newsletter safety on October 29, 2026, and ARARA responded that no information leak had been found. ARARA publicly announced unauthorized access to its systems on November 1, 2026, after which SEGA requested another check. ARARA informed SEGA by email on November 3, 2026 that subscriber addresses for its newsletters had been exposed outside the company. Additional checks between November 5 and November 8, 2026 resulted in SEGA receiving ARARA’s formal incident report.

The breach affects 11 newsletters tied to SEGA and SEGA Fave products and services. Six of the 11 are linked to the SEGA Lucky Kuji Online prize game service. The leaked email addresses came from newsletters sent between July 2 and October 28, 2026, covering SEGA Lucky Kuji, Tokyo Game Show 2026, CHUNITHM, ONGEKI, and maimai. SEGA paused all newsletter distributions through ARARA pending verification of the exposed data and completion of safety reviews.

The wider ARARA compromise exposed about 77 million email addresses from almost 380 corporate clients. Other affected firms included MOS Burger, Shochiku Multiplex Theatres, TKC and IIJmio. Paycloud Holdings confirmed on November 2, 2026 that hackers accessed subsidiary servers holding information for around 380 corporate clients, though no credit card details were exposed. SEGA’s newsletter exposure is part of that wider vendor incident.

In late October 2026, attackers abused access to ARARA’s service to dispatch over seven million e-mails that pretended to be from credit card companies. The mass mailings show how attackers exploited the compromised mail service. ARARA said a web server flaw and system environment problems contributed to the breach. Investigators have not yet determined the exact intrusion method or timing.

The ARARA newsletter breach is unrelated to a separate cybersecurity incident affecting SEGA FAVE’s ALL.Net and Aime arcade gaming network services. The two incidents are concurrent but distinct, involving separate SEGA services. SEGA FAVE disclosed on November 2, 2026 that intruders accessed arcade servers, prompting suspensions covering online play, the Lucky Kuji Online service, and new SEGA ID signups. The arcade probe found no signs that customer or business partner data was taken, and payment data was not affected because it resides on separate systems.

SEGA warned customers to watch for suspicious e-mails purporting to be from SEGA, SEGA Fave, ARARA, or associated products and services. The company said its representatives will not request passwords or credit card details through e-mail and told customers to delete unexpected messages instead of opening links or attachments. After SEGA establishes the details, it plans to get in touch with each affected customer individually.

The companies plan a joint submission to Japan’s Personal Information Protection Commission regarding the incident. SEGA issued a public apology on November 9, 2026 for the inconvenience and concern caused to customers and all parties involved. SEGA was working with Arara and related companies to confirm leaked details.

We are currently investigating the information associated with newsletter distribution in cooperation with ARARA

SEGA, BleepingComputer

We deeply apologize for the great inconvenience and concern caused to our customers and all parties involved

Sega, Infosecurity Magazine

We deeply apologize for the significant concern and inconvenience caused to our customers and related parties.

SEGA Corporation, Homeland411