Sega says Arara breach exposed 2.19 million newsletter emails

What Sega disclosed

Sega published a statement on 9 November 2026 saying 2,196,044 email addresses from its newsletters had left the servers of Arara, the Japanese company that sends them on its behalf. Of those, 92,273 carried additional information that accompanied the mailing; Sega said that part is still under review.

The company said the exposed data does not include names, dates of birth, sex, postal addresses or telephone numbers. It also said no card data or login passwords were involved. Addresses registered to SEGA Account were outside the breach because that system uses a different sending service.

Sega listed 11 newsletters sent between 2 July and 28 October 2026, from CHUNITHM Mate to Sega Lucky Kuji campaigns, including ONGEKI Re:Fresh Act.2, maimai de luxe and two mailings about Tokyo Game Show 2026.

A vendor's changing account

The timeline is the part Sega's statement does not smooth over. On 29 October, according to the report, Arara told Sega there had been no leak. On 3 November it confirmed that Sega's addresses had been exposed.

Arara's own first public notice, dated 29 October, placed the unauthorised access on the previous day and said 3.01 million email addresses had been compromised in a single system. It attributed the access to a web server vulnerability exploited by a third party, with additional problems in its environment.

A third Arara report, dated 6 November, counted 81,329,467 unique addresses and up to 380 corporate clients. The gap between 3.01 million and 81.3 million is not rounding: the report describes two counting methods and an investigation that moved from one server to three separate environments in eleven days. The mailing service has been stopped since 31 October.

The phishing risk

Arara's third report said that between 28 and 30 October, up to 7.13 million messages went out from its infrastructure impersonating card companies, with subjects such as a request to confirm usage data. The attackers did not need passwords; the sending infrastructure let them write in the vendor's voice.

Sega's statement asks recipients not to open links or attachments and says the company does not ask for passwords or card data by email. Arara said its service does not store card numbers, so messages requesting them had nothing to check against.

The report places the Sega case alongside other Japanese breaches traced to third-party services, including Asoview with 15.82 million records, Bic Camera with 15.2 million addresses, MOS Burger with 7.5 million emails and Iris Ohyama with 7.7 million affected people.

A second, separate incident

Sega Lucky Kuji Online remains in maintenance after a different incident: unauthorised access to the servers of Sega Fave's ALL.Net and Aime arcade networks, acknowledged on 2 November. Sega says the two cases are unrelated.

That second system authenticates game sessions and machine records. The report gives no date for its return.