SEGA confirms third-party breach exposed 2.19 million email addresses
Original title: SEGA Confirms Data Breach After Third-Party Email Provider Exposes 2.19 Million Customer Email Addresses
Exposed records are newsletter addresses, not SEGA Account logins; names, passwords, and card data were not included.
SEGA said unauthorized access to Arara Message, a newsletter provider, exposed 2,196,044 email addresses tied to SEGA and SEGA Fave promotions. Delivery-related information for 92,273 addresses is still being reviewed. SEGA Account addresses were on a different system and were not included. Arara said attackers exploited a web server vulnerability, with theft continuing until the service stopped on October 31. No misuse is confirmed.
Unconfirmed: SEGA has not confirmed the extra fields for 92,273 addresses, and Arara’s exploited vulnerability is unnamed.
- Affected newsletters were sent between July 2 and October 28, 2026.
- Arara notified SEGA on November 3 that newsletter addresses had leaked.
- SEGA plans a joint report to Japan’s Personal Information Protection Commission.
- Sega Lucky Draw Online maintenance is a separate SEGA Fave incident.
Impact: 2,196,044 newsletter email addresses exposed
| Product | Affected |
|---|---|
| Arara Message | — |
- 1.Avoid unexpected links and attachments claiming to be from SEGA, SEGA Fave, or Arara.
- 2.Do not provide passwords or card details by email.
- Products
- Arara Message
- Organizations
- AraraPersonal Information Protection Commission
- Countries
- Japan
From the original article
2 min read at cybersecuritynews.com
SEGA confirmed that attackers exposed 2,196,044 email addresses after gaining unauthorized access to Arara Message, a third-party service used to send newsletters. The company disclosed the breach on November 9, 2026, saying the affected records related to promotional emails for SEGA and its group company, SEGA Fave. The SEGA data breach also exposed information linked […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.