Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

Sega confirms Arara vendor breach exposed 2.2 million newsletter emails

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 10: GBHackers reports Sega confirmed the breach on November 9, Arara set the theft window as October 28–31, and Message restoration is unscheduled.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Sega says an Arara Message breach exposed 2,196,044 newsletter emails; misuse is unconfirmed and the service remains suspended.

Sega confirmed that unauthorized access to Japanese email vendor Arara Inc. exposed 2,196,044 newsletter addresses tied to Sega and Sega Fave promotions. Names, passwords, postal and phone details, birth dates, and payment data were not included, and Sega Account logins were on a separate system. Arara said attackers exploited a web server vulnerability and stole data from October 28 until Message stopped on October 31. Infosecurity Magazine reports 92,273 distribution items leaked; Cyber Security News says delivery details remain under review, while GBHackers says those addresses included delivery information. No misuse is confirmed. Sega plans a joint report to Japan’s privacy regulator, and Arara newsletters stay suspended.

Key facts
  • 2,196,044 newsletter addresses exposed; Infosecurity rounds this to 2.196 million.
  • Theft ran from October 28 until the October 31 service shutdown.
  • Sega Account logins, passwords, and payment data were not included.
  • Arara notified Sega on November 3; Sega confirmed the breach on November 9.
  • No misuse is confirmed; customers were warned about impersonation email.
  • Arara Message remains suspended, with restoration unscheduled.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 2, 2026Affected Sega newsletters began sending, through October 28. · Cyber Security News
  2. Oct 28, 2026Attackers began stealing data after a server compromise. · Infosecurity Magazine
  3. Oct 31, 2026Arara suspended Message and the theft stopped. · Cyber Security News
  4. Nov 3, 2026Arara notified Sega that newsletter addresses had leaked. · Cyber Security News
  5. Nov 9, 2026Sega publicly confirmed the vendor email breach. · GBHackers

What each outlet adds

beyond the shared facts
  • Infosecurity MagazineCounts 380 corporate clients and 77 million emails affected.
  • Cyber Security NewsSega Account was separate; joint privacy-commission report planned.
  • GBHackersConfirmation date, corrected theft window, and unscheduled restoration.
Vendors
SegaArara Inc.Paycloud HoldingsArara
Products
Arara Message
Victims
Sega customersSEGASEGA Fave
Organizations
AraraPersonal Information Protection Commission
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Infosecurity MagazineFirst report

    2.2 million Sega customer email addresses leaked in vendor breach

    2.2 million Sega customer email addresses exposed after third-party vendor compromise with no misuse confirmed.

  2. · 1d ago Cyber Security News

    SEGA confirms third-party breach exposed 2.19 million email addresses

    Exposed records are newsletter addresses, not SEGA Account logins; names, passwords, and card data were not included.

  3. · 1d ago GBHackers

    SEGA says Arara breach exposed 2.19 million customer emails

    Attackers took the addresses from newsletter platform Arara Message between October 28 and October 31; passwords and payment data were not included.