SEGA says Arara breach exposed 2.19 million customer emails
Original title: SEGA Confirms Data Breach Exposing 2.19 Million Customer Email Addresses Following Third-Party Cyberattack
Attackers took the addresses from newsletter platform Arara Message between October 28 and October 31; passwords and payment data were not included.
SEGA confirmed on November 9, 2026, that a breach of newsletter provider Arara exposed 2,196,044 customer email addresses. Arara said attackers exploited a web server vulnerability and continued theft until the service shut down on October 31. Names, birth dates, addresses, phone numbers, card details, and passwords were not compromised. SEGA has not confirmed misuse and warned of impersonation mail while Arara-based newsletters stay suspended.
Unconfirmed: No vulnerability identifier or attacker was named, and SEGA has not confirmed misuse of the addresses.
- Of the exposed addresses, 92,273 included newsletter delivery information.
- Arara corrected the theft window to October 28 through October 31.
- SEGA was told of its exposure on November 3 after an earlier denial.
- A separate SEGA Fave arcade-network incident is not this breach.
- Restoration of Arara Message remained unscheduled.
Impact: 2,196,044 customer email addresses stolen
| Product | Affected |
|---|---|
| Arara Message | — |
- 1.Avoid unknown links, attachments, and replies, including messages claiming to be from Arara.
- 2.Treat email requests for passwords or card details as phishing.
- Vendors
- Arara
- Products
- Arara Message
- Victims
- SEGA
From the original article
2 min read at gbhackers.com
SEGA confirmed on November 9, 2026, that attackers stole 2,196,044 customer email addresses after breaching Arara, its newsletter provider. Of these, 92,273 included information linked to newsletter delivery. The incident affected messages promoting SEGA and SEGA Fave products, highlighting the risks of third-party breaches.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.