Gaming giant Sega has revealed that a third-party cybersecurity incident compromised nearly 2.2 million customer email addresses. The data exposure stems from a larger security breach at Arara, a technology firm providing digital marketing and customer engagement services to numerous Japanese companies.
Sega disclosed that 2,196,044 email addresses used for newsletter distribution were leaked externally, alongside 92,273 additional records related to email distribution for Sega and its subsidiary, Sega Fave Corporation. The company stated that sensitive details such as customer names, dates of birth, gender, postal addresses, phone numbers, credit card information, and login passwords were not compromised in the incident. Furthermore, Sega confirmed that email addresses registered with standard Sega Accounts utilize a separate distribution system and remained unaffected.
Key takeaways
- Sega disclosed a third-party breach exposing 2,196,044 customer email addresses.
- An additional 92,273 records related to email distribution were also compromised.
- The incident originated from a security compromise at digital marketing provider Arara.
- Sega confirmed no misuse of the leaked information has been reported yet.
The Arara Supply Chain Attack
The breach originates from a widespread supply chain attack targeting Arara Inc., which manages contact information and email distribution infrastructure for up to 380 corporate customers through its Arara Message platform. In early November 2026, Arara suffered an infrastructure compromise caused by a web server vulnerability and other system weaknesses. Unidentified threat actors accessed 97 servers, potentially exfiltrating more than 81 million email addresses alongside names, dates of birth, phone numbers, postal addresses, and membership numbers across multiple client organizations.
Other prominent Japanese companies were severely impacted by the Arara compromise. Electronics retailer Bic Camera reported 15.2 million affected records, Asoview disclosed approximately 15.82 million, fast-food chain MOS Burger revealed 7.5 million exposed email addresses, and cinema operator Shochiku Multiplex Theaters reported 3.3 million. Attackers also compromised a separate Arara environment containing 3.38 million email addresses and over 400,000 records containing personally identifiable information, eventually dispatching more than seven million phishing emails spoofing credit card companies and forcing a temporary shutdown of the service on October 31, 2026.
Impact and Additional Incidents for Sega
Neither Sega nor Arara has confirmed any malicious misuse of the leaked data so far. However, both companies have issued warnings advising users to remain vigilant against phishing risks and to avoid clicking links or downloading attachments from suspicious emails purporting to come from the organizations.
This data exposure marks Sega's second major cybersecurity challenge. Earlier in November 2026, the company suffered an unrelated incident when unidentified threat actors accessed servers supporting the ALL.Net and Aime arcade gaming network services for its Sega Fave division, bringing online gameplay, Sega Lucky Kuji Online, and new Sega ID registrations offline for maintenance and safety checks.
Comments