Sega says vendor breach exposed 2.2 million customer emails

Sega said on 9 November 2026 that an unauthorised third party had exposed 2.196 million customer email addresses after accessing Arara Inc., a Japanese email delivery provider used to send Sega newsletters. The breach also involved 92,273 items related to email distribution. Sega said the exposed data did not include names, dates of birth, gender, addresses, telephone numbers, credit card details or login passwords.

The company said it was working with Arara and other relevant firms to establish what information had been leaked, while Arara investigated the cause and steps to prevent further damage.

Sega said it had no confirmed cases of the leaked data being misused, but warned customers to watch for suspicious emails claiming to come from Sega, its subsidiary Sega Fave, or their products and services. It said neither company would ask for passwords or credit card details by email, and advised recipients not to open links or attachments in unfamiliar messages.

Arara said unauthorised access to some servers for its email distribution service occurred on 28 October 2026 after attackers exploited web-server vulnerabilities. The Arara Message service was suspended on 31 October and remained offline at the time of the report. Paycloud Holdings, Arara’s parent company, said the incident affected information held for around 380 corporate clients, including 77 million email addresses; data exposed varied by company and could also include names, telephone numbers and addresses.