Sega disclosed a third-party breach that exposed nearly 2. 2 million customer email addresses through a marketing service provider
Around 92,000 additional records related to email distribution were also compromised in the incident
Sega and its provider warned users about phishing risks, though no misuse of the leaked data has been confirmed
Gaming giant Sega has disclosed suffering a third-party cybersecurity incident that exposed email addresses of almost 2. 2 million people, as well as other details of at least 92,000. The company is now investigating deeper, to confirm the details of the leaked information. What happened
Sega is one of many Japanese companies using the services of Arara, a technology firm providing digital marketing and customer engagement services. One of its services is called Arara Message, an email distribution platform that businesses can use to send newsletters and other communications to millions of people. This also means Arara was managing contact information on behalf of those organizations, including email addresses, names, and often phone numbers and membership details. In early November 2026, Arara reported its email distribution infrastructure suffering a compromise. Apparently, a combination of a web server vulnerability and “other system weaknesses” allowed unidentified threat actors to access 97 servers that stored data of up to 380 corporate customers. The attackers accessed (and most likely exfiltrated) more than 81 million email addresses, together with people’s names, dates of birth, phone numbers, postal addresses, and membership numbers. Not every customer had all of this data exposed – it varied from person to person. In a subsequent report, Arara added that the attackers compromised a separate environment containing additional 3. 38 million email addresses and more than 400,000 customer records containing PII. They ended up sending more than seven million phishing emails spoofing various credit card companies, forcing the company to temporarily shut down the service on October 31 2026. Many large organizations had their newsletter contacts exposed. Asoview reported approximately 15…