SEGA says 2,196,044 email addresses leaked from a newsletter delivery service run by a Japanese vendor, ARARA, and the company confirmed the exposure on Nov. 9. The addresses sat in mailing lists for 11 newsletters sent between July and October 2026, covering arcade game launches, Tokyo Game Show exhibit notices and the SEGA Lucky Kuji prize-draw sales. SEGA’s own systems were not the point of entry.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The company says the exposed records held no names, birth dates, addresses, phone numbers, card details or passwords, and it has no confirmed evidence that the addresses have been misused.
What SEGA confirmed about the 2.2 million addresses
In its Nov. 9 notice, SEGA reports that an unauthorized third party got into the “ARARA Message” email delivery system that SEGA and its SEGA Fave arcade unit used for some mailings. Of the 2,196,044 addresses involved, 92,273 also had delivery information attached, and SEGA says it is still checking what that information contains. Addresses registered to a SEGA Account run through a different distribution system and were not affected. The timeline in the notice is awkward for the vendor: on Oct. 29 ARARA told SEGA after a check that no leak had occurred, and only on Nov. 3 did it tell SEGA the addresses had in fact been exposed, with further checks and a formal report following through Nov. 8. The eleven newsletters are listed individually in the notice, from a July 2 launch announcement for the CHUNITHM Mate arcade title to Lucky Kuji sales messages dated Oct. 21 and Oct. 28. A subscriber who signed up for any one of them could be on the leaked list.
ARARA’s two intrusion paths and the 77 million figure
ARARA’s own second report, dated Nov. 2, describes two separate break-ins. In the first, on Oct. 27 and 28, an attacker logged into an administration console on a shared environment and used data export functions. In the second, between Oct. 28 and 31, an attacker used one service server as a springboard to copy databases from others, including 97 client-environment servers, and ARARA spotted that activity on Oct. 31.
The vendor estimates about 77 million email addresses were taken through the service route, from up to roughly 380 client companies, with the caveat that one person may hold several addresses. Separately, about 3.39 million addresses left the shared environment. ARARA did not add the categories together because they may overlap, and it names a web server vulnerability plus problems in its system environment as contributing causes. The shared environment alone touched 61 companies, and ARARA says up to 411,827 customer records from five of its clients were also taken. Stopping the service took until the evening of Oct. 31, when all operations were halted and shutdown finished at 19:53. ARARA has set no restart date and says clients will be asked to reset passwords and API keys first. It has also notified the authorities and privacy bodies, and its plan calls for a full credential overhaul, a rebuilt system environment and stronger monitoring before any relaunch.
Phishing mail sent from the vendor’s own address
The attackers also used the platform as a megaphone. From Oct. 28 to 30, ARARA says, its service was misused to send up to about 7.13 million fake credit-card-company emails from the address [email protected], with subjects asking recipients to confirm card usage details. Recipients were told not to open links or attachments in those messages and to contact their card issuer if they had entered card information.
For SEGA subscribers, the practical exposure is a verified address that is tied to a gaming brand, which is useful raw material for a convincing lure. SEGA did not describe any phishing aimed at its own list, and its notice says no misuse had been confirmed as of Nov. 9.
Other ARARA clients and a separate SEGA incident
SEGA is one of many. MOS Burger said in a Nov. 4 notice that 7,517,087 addresses from its MOS WEB membership service were exposed, and the accounting software firm TKC reported in its third bulletin that up to 2,230,812 addresses of customers using its systems leaked. TKC says only email addresses were involved and that its own email sending is suspended while ARARA is offline. BleepingComputer’s tally adds Shochiku Multiplex Theatres at 3.3 million records and IIJmio at nearly 1 million addresses.
BleepingComputer’s report by Bill Toulas notes that a different SEGA matter surfaced the same week: on Nov. 2, SEGA Fave disclosed unauthorized access to servers behind its ALL.Net and Aime arcade network. SEGA Fave said initial findings showed no evidence that customer or business partner data was stolen, that payment information is stored separately, and that related arcade services stayed offline for maintenance and safety checks. SEGA says the two incidents are unrelated, and ARARA’s investigation into the exact intrusion method and timing was still open when SEGA published its notice.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Neanderthals in Spain carved a wooden object that matches nothing archaeologists have ever found
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
- A $1 billion gas plant planned for Superior, Wisconsin, has been abandoned
- Shaq spent $1.3 million on three Rolls-Royce Phantoms to prove a point to a salesman
