SEGA says third-party email breach exposed 2.19 million newsletter addresses
SEGA says a breach at newsletter provider Arara exposed 2,196,044 email addresses, but not passwords, payment details or SEGA Account addresses.
SEGA says a third-party email-distribution system used for some newsletters was accessed without authorisation, exposing 2,196,044 email addresses and associated distribution information. The company says 92,273 of those records also contained information linked to distribution. The disclosure was published on 9 November 2026.1
SEGA says the affected system belongs to Arara, a separate email-delivery provider used for some SEGA and SEGA Fave newsletters. The company says names, birth dates, genders, addresses, telephone numbers, credit-card details and login passwords were not included in the exposed information it has identified. SEGA Account email addresses use a different distribution system and are not part of this incident, according to the company.1
The affected mailings included announcements for CHUNITHM Mate, ONGEKI Re:Fresh Act.2, Tokyo Game Show 2026, maimai and SEGA Lucky Kuji Online between July and October. SEGA says no misuse of the leaked information has been confirmed so far, but warns that attackers could use the exposed addresses to impersonate SEGA, SEGA Fave or Arara in suspicious emails.1
SEGA has paused newsletters sent through Arara's system while it and the provider investigate the cause and the full scope of the incident. The company says it plans to contact affected people once the details are confirmed and will publish further information if new facts emerge.1
What SEGA has confirmed
The confirmed exposure concerns newsletter recipient addresses and information associated with delivery. It is not a report that SEGA Account credentials, payment-card data or newsletter recipients' full personal profiles were exposed. The exact contents of the associated distribution information remain under investigation.1
Readers who receive an unexpected message claiming to come from SEGA, SEGA Fave or Arara should avoid opening links or attachments. SEGA says it will not ask for passwords or credit-card details by email. That advice is sensible while the provider's investigation continues, but it does not mean every suspicious message is necessarily connected to this incident.
Our opinion
This is serious because a large mailing list can make convincing phishing campaigns easier, even when passwords and payment information are not involved. The useful distinction is between what SEGA has confirmed and what remains unknown: the address count is specific, while the wider distribution data and any misuse are still being examined. Until that investigation is complete, readers should treat unsolicited account or prize messages as suspect without assuming that SEGA accounts themselves have been breached.
SEGA says it will update the notice as the investigation progresses. That follow-up should establish which associated fields were exposed, whether the list was accessed more broadly than currently known and whether affected recipients will receive individual notifications.