The Nerd Senpaii breaks down the biggest gaming story of the afternoon: SEGA has confirmed a data breach that leaked the email addresses of 2,196,044 newsletter subscribers — and the attack came through the company that sends SEGA's newsletters, as part of a supply-chain breach that may have exposed as many as 81 million email addresses. Senpai covers what was taken, what was not, the separate arcade-network incident, and exactly what you should do to protect yourself.
Listen to the episode below, or on Spotify and Apple Podcasts.
Listen on Spotify: https://open.spotify.com/episode/7vkaNtqdm3ohUuxEKvVgw4
Read the full breaking-news write-up: SEGA Confirms Data Breach: 2.2 Million Email Addresses Leaked
Support the show: https://www.patreon.com/c/TheNerdsListDaily
Transcript
Key moments:
- 00:00 — The breach: SEGA confirms 2,196,044 newsletter emails leaked
- 00:35 — What was taken: 11 newsletter batches, July 2–Oct 28
- 01:05 — What was NOT taken: no names, passwords, or payment data; SEGA accounts unaffected
- 01:35 — The bigger picture: Arara, 97 servers, ~380 companies, 81.3M emails
- 02:02 — 7.13 million fraudulent emails sent from a trusted system
- 02:24 — The separate arcade incident: ALL.Net and Aime dark since Nov 1
- 02:58 — What to do: phishing warning, unique passwords
- 03:42 — Context: Capcom's 11M breach, Japan's emergency package
- 04:28 — The close: follow the show
"SEGA was not even the direct target. The attackers went after the company that sends SEGA's newsletters, and that one attack may have exposed as many as eighty-one million email addresses across hundreds of companies."
"A leaked email address is the first ingredient in a phishing attack, and the password you reuse everywhere is the second."
[ 0.00 - 4.48] Breaking news. And this one hits close to home for anyone who has ever signed up for a gaming news
[ 4.48 - 9.60] letter. This is the nerd Senpai. And SEGA has just confirmed a data breach that leaked the email
[ 9.60 - 18.24] addresses of more than 2 million people. 2,196,044 to be exact. And here's the twist. SEGA was not even
[ 18.24 - 22.80] the direct target. The attackers went after the company that sends SEGA's newsletters,
[ 22.80 - 27.68] and that one attack may have exposed as many as 81 million email addresses across hundreds of
[ 27.68 - 32.96] companies. We're going to break down exactly what happened, what was taken, what was not,
[ 32.96 - 38.40] and what you need to do right now. Here's what SEGA confirmed today, November 9th, 2026.
[ 38.40 - 46.00] The email addresses of 2,196,044 people who received SEGA's newsletters were leaked in a data breach.
[ 46.56 - 51.60] The breach came through Arara, the company that distribute SEGA's newsletters. The leaked data
[ 51.60 - 58.96] covers 11 newsletters, sent between July 2nd and October 28th, 2026. SEGA says there is no
[ 58.96 - 65.12] indication that names, birth dates, genders, postal addresses, phone numbers, credit card information,
[ 65.12 - 71.04] or login passwords were leaked. And if you have a SEGA account, listen up. SEGA says account
[ 71.04 - 76.80] holders are not affected, because SEGA accounts run on a separate system. There is one caveat,
[ 77.68 - 84.88] 92,273 of the leaked records also carried what SEGA calls delivery accompanying information.
[ 85.36 - 89.20] And SEGA and Arara are still verifying exactly what those rows contain.
[ 90.00 - 95.52] So the headline number is emails only, but a small slice of the data still has an open question mark
[ 95.52 - 101.92] on it. Now here is where this story gets much bigger than SEGA. Arara runs a bulk email platform,
[ 101.92 - 106.72] and its own investigation found that attackers reached 97 servers holding the mailing lists of
[ 106.72 - 112.96] up to roughly 380 client companies. Arara's third report, published November 6th, raised the
[ 112.96 - 122.08] platform wide total to 81,329,467 de-duplicated email addresses, and the attackers did not just
[ 122.08 - 128.56] steal the lists. They also used Arara's mail servers to send roughly 7.13 million fraudulent emails
[ 128.56 - 133.20] from a legitimate looking sender address. That is the part that should worry everybody,
[ 133.20 - 138.16] because those emails came from a trusted system, which makes them far more convincing than the usual
[ 138.16 - 144.16] spam. Arara shut the whole platform down on October 31st, and it has not restarted it.
[ 144.16 - 149.92] And SEGA was dealing with a second incident at the same time. On November 2nd, SEGA Fave reported
[ 149.92 - 156.24] unauthorized access to all net, the arcade network, and aim player cards. SEGA stopped the network
[ 156.24 - 161.84] on November 1st, taking games from SEGA and Bandai Namco dark in arcades across Japan,
[ 161.84 - 167.92] with no restart date yet. No data leak has been found so far in that incident, and SEGA says it is
[ 167.92 - 173.60] still investigating the cause. So SEGA has had two separate security incidents in the same week,
[ 173.60 - 178.40] one hitting its newsletters, and one hitting its arcades, and they are not the same breach.
[ 178.40 - 183.36] So what should you do if you get SEGA newsletters? First, SEGA has suspended its newsletter
[ 183.36 - 188.40] distribution, and it says it will contact affected users individually once the details are confirmed.
[ 189.04 - 194.72] Second, treat any unexpected email claiming to be from SEGA with suspicion. Do not click links
[ 194.72 - 200.32] or attachments, and go to SEGA's official site directly to check anything. Remember, the attackers
[ 200.32 - 205.44] sent millions of fraudulent emails through a trusted system, so a convincing looking SEGA email
[ 205.44 - 210.80] is exactly what this breach makes possible. Third, even though SEGA says no passwords were
[ 210.80 - 215.84] exposed here, make sure your passwords are unique across your accounts, because a leaked email
[ 215.84 - 221.04] address is the first ingredient in a phishing attack, and the password you reuse everywhere is the
[ 221.04 - 226.64] second. Some context, because this is not happening in a vacuum. This is the second major Japanese
[ 226.64 - 232.08] gaming breach in as many weeks. In late October, Capcom confirmed a similar incident affecting more
[ 232.08 - 238.24] than 11 million Capcom IDs, and just last week, on November 6th, Japan's government put together
[ 238.24 - 243.04] an emergency package, and the police opened a nationwide joint investigation into this year's
[ 243.04 - 248.16] large breaches. SEGA says it will strengthen how it handles personal data entrusted to outside
[ 248.16 - 253.68] providers, and it plans a joint report with Arara to Japan's privacy regulator. The pattern is
[ 253.68 - 258.80] clear. Attackers are going after the vendors and the service providers behind the big names,
[ 258.80 - 263.52] not just the big names themselves, and that means a breach at a company you have never heard of can
[ 263.52 - 268.56] still put your email address at risk. That is the breaking news, and we will update this story
[ 268.56 - 273.84] as SEGA and Arara share more. If you want to stay on top of stories like this one, follow the
[ 273.84 - 279.20] NerdsList Daily, right here, wherever you get your podcasts. New episodes drop every morning
[ 279.20 - 285.60] at 5 a.m. Eastern. You can also read the full write-up at the NerdsList.com. Stay safe out there,
[ 285.60 - 293.20] watch your inbox, and I will see you next time. This is the NerdsSendPie.
0 Comments