SEGA has confirmed a data breach that leaked the email addresses of 2,196,044 people who receive the company's newsletters. The company published the disclosure today, November 9, 2026, blaming a third-party attack on Arara, the company that distributes SEGA's newsletters — and SEGA's breach is one slice of a much larger supply-chain attack that may have exposed as many as 81 million email addresses across hundreds of companies.
Here is what was taken, and what was not. The leaked data covers eleven newsletter batches sent between July 2 and October 28, 2026. SEGA says there is no indication that names, birthdates, genders, postal addresses, phone numbers, credit card information, or login passwords were leaked. People with a SEGA account are not affected — SEGA Accounts run on a separate system. One caveat: 92,273 of the leaked records also carried what SEGA calls "delivery-accompanying information," and SEGA and Arara are still verifying exactly what those rows contain.
The bigger picture is much larger than SEGA. Arara runs a bulk-email platform, and its investigation found that attackers reached 97 servers holding the mailing lists of up to roughly 380 client companies. Arara's third report, published November 6, raised the platform-wide total to 81,329,467 deduplicated email addresses. Attackers also used Arara's mail servers to send roughly 7.13 million fraudulent emails from a legitimate-looking sender address. Arara shut the whole platform down on October 31 and has not restarted it.
SEGA's arcade network was hit separately. On November 2, SEGA Fave reported unauthorized access to ALL.Net, the arcade network, and Aime player cards. SEGA stopped the network on November 1, taking games from SEGA and Bandai Namco dark in arcades across Japan, with no restart date yet. No data leak has been found so far in that incident, and SEGA says it is still investigating the cause.
What to do if you get SEGA newsletters. SEGA has suspended its newsletter distribution and says it will contact affected users individually once the details are confirmed. Until then, treat unexpected emails claiming to be from SEGA with suspicion — do not click links or attachments, and go to SEGA's official site directly to check anything. The leaked addresses are prime fuel for phishing, so make sure your passwords are unique, even though SEGA says none were exposed here.
This is the second major Japanese gaming breach in as many weeks: in late October, Capcom confirmed a similar incident affecting more than 11 million CAPCOM IDs. SEGA says it will strengthen how it handles personal data entrusted to outside providers and plans a joint report with Arara to Japan's privacy regulator.
More on this story as it develops at thenerdslist.com.
0 Comments