SEGA has disclosed that a breach at its email delivery provider exposed nearly 2.2 million customer email addresses used for newsletters promoting its games, events, and merchandise.
The November 9 announcement concerns unauthorized access to ARARA’s “ARARA Message” service and is separate from the server intrusion that recently forced SEGA FAVE to suspend arcade network services.
According to SEGA’s announcement, the exposed data comprises 2,196,044 email address records, including 92,273 that also contained information associated with newsletter delivery. The company is still working with ARARA to establish what that additional information includes.
SEGA is the Japanese gaming company behind franchises such as Sonic the Hedgehog. It and its group company SEGA FAVE, which develops arcade machines, prize products, and toys, used ARARA’s system to distribute some newsletters about their products and services.
The affected mailings were sent between July 2 and October 28, 2026. They included SEGA Lucky Kuji lottery product announcements, Tokyo Game Show 2026 exhibition information, and notices about CHUNITHM, ONGEKI, and maimai arcade game releases.
SEGA says the leaked information does not include customer names, dates of birth, gender, postal addresses, telephone numbers, credit card details, or login passwords. Email addresses registered with SEGA Account are outside the scope of this breach because that service uses a different delivery system.
The company has not confirmed misuse of the exposed information. Its disclosure counts email address records and does not establish how many individual customers were affected.
SEGA first asked ARARA to verify the safety of its newsletter distribution on October 29, as part of checks on its security environment. The provider initially reported that it had not confirmed any information leak.
After ARARA publicly disclosed unauthorized access on November 1, SEGA requested another check. On November 3, ARARA notified SEGA by email that addresses used for its mailings had been leaked externally. Further checks followed between November 5 and 8, during which SEGA received a formal report.
The disclosure follows a separate intrusion affecting SEGA FAVE’s arcade infrastructure, which disrupted ALL.Net and Aime-related services. SEGA explicitly distinguishes the ARARA breach from that incident. SEGA Lucky Kuji Online remains under maintenance as part of security checks related to the arcade server intrusion.
SEGA has suspended newsletters sent through ARARA until it verifies the exposed information and completes safety checks. It plans to contact affected customers individually once the details are established. SEGA also plans to file a joint report with Japan’s Personal Information Protection Commission through ARARA.
Customers should watch for messages impersonating SEGA, SEGA FAVE, ARARA, or associated products and services. The gaming firm advises recipients to avoid links and attachments in unexpected emails, reminding them that it will never ask for passwords or credit card information by email.
Leave a Reply