SEGA said on 9 November 2026 that a third party reached Arara Message, the mailer SEGA and SEGA Fave used for some product newsletters, and that 2,196,044 delivery addresses left. The catalog entry records that take as emails, not unique people. Of those addresses, 92,273 also have delivery-side accompanying data still under review with Arara. Names, dates of birth, sex, addresses, phones, payment cards and login passwords were not in the leaked set. Mailboxes registered to a SEGA Account sit on a different mailer and are out of scope. No misuse was confirmed as of the notice.
This is a vendor incident, not a SEGA Account password dump. It sits next to the ARARA Message platform row, which already counts 81,329,467 unique emails across about 380 client firms. Do not add the SEGA 2.20 million into that platform total. AIRDO, Solaseed Air, JERA Sunday and Yokohama Rubber published the same-week client notices. SEGA is another named client with a published email census.
What happened in the SEGA data breach?
SEGA asked Arara about newsletter safety on 29 October 2026 and was told no leak had been found. After Arara's 1 November public notice, SEGA asked again. On 3 November Arara said SEGA newsletter addresses had left. Additional checks ran 5 to 8 November. The 9 November page is the customer notice. Cause at Arara is unpublished beyond unauthorised access to Arara Message.
The leaked lists are specific newsletters from July to October 2026: CHUNITHM Mate, Ongeki Re:Fresh, maimai DX MAGICAL, Tokyo Game Show 2026 booth mail, and SEGA Lucky Kuji sale mail. If you only use a SEGA Account and never joined those lists, this notice does not put your account mailbox in the take. If you opened those campaign mails, treat the listed address as exposed even without a personal letter yet. SEGA says individual mail will follow once Arara finishes the accompanying-data review.
Lucky Kuji Online is separately offline because of a SEGA Fave ALL.Net and Aime server intrusion disclosed 2 November. That is a different company, a different system, and no customer leak confirmed yet. Cards are not stored on those arcade servers, SEGA Fave says. Do not merge the two rows.
SEGA and Arara plan a joint report to Japan's Personal Information Protection Commission. Newsletter sends through Arara stay paused until SEGA says the mailer is safe. Watch for fake SEGA, SEGA Fave or Arara mail that asks for a password or a card number. Officials will not collect those through a surprise link.
What data was exposed?
Email addresses used for the listed newsletters, plus accompanying delivery data for 92,273 of them. Accompanying data is still being inventoried with Arara, so do not invent field names. The notice is explicit about what was not taken: name, date of birth, sex, address, phone, card data, login password. That is a narrower take than a SEGA Account dump. It is still a phishing file. 2.20 million addresses that already receive SEGA campaign mail are useful for lookalike Lucky Kuji or TGS lures.
The ARARA platform total is unique emails across many clients, not a SEGA people count. AIRDO published up to 673,920 emails. Solaseed Air published about 490,000. Yokohama Rubber has not published a count. Keep those under their own companies. The ARARA platform post is the vendor overview.
SEGA Account holders should still use unique passwords and multi-factor authentication, because reuse is common, not because this notice lists account passwords. If you used the same mailbox on an arcade Aime card and a newsletter, only the newsletter address is in this row on the current text.
Who is affected?
People on the listed SEGA and SEGA Fave product newsletters between 2 July and 28 October 2026. That can include players, Lucky Kuji buyers and TGS mail subscribers. SEGA Account-only users are outside this row. Staff identity files are not in the notice. Arcade ALL.Net and Aime players are in the separate Fave investigation, which has not confirmed a leak.
What should I do?
- Treat unexpected SEGA, SEGA Fave, Lucky Kuji or Arara mail that asks for a password or a card as hostile. The notice says those firms will not request that by email.
- Do not open links or attachments in campaign lookalikes. The leaked addresses already receive product mail, so the lure can quote a real game name.
- If you only used a SEGA Account mailbox, this row does not put that address in the take. Keep the 9 November notice anyway.
- Japan: PPC and the SEGA customer form linked from the notice are the official channels. Phone 0570-000-353, 10:00 to 17:00.
- When SEGA publishes the accompanying-data field list or a unique-people census, that update replaces today's email count.
The AIRDO catalog row is the other named Arara client with a public email census this week. The Iris Plaza cloud row is a different Japanese vendor incident, not Arara.
Frequently asked questions
How many people were affected?
SEGA published 2,196,044 email addresses, not a unique-people census. 92,273 of those also have delivery-side data still under review.
Were SEGA Account passwords leaked?
No. The notice says login passwords, names, cards and SEGA Account mailboxes on the other mailer were not in the take.
Is this the same as the ALL.Net outage?
No. ALL.Net and Aime sit on SEGA Fave arcade servers. That intrusion has no confirmed customer leak. Lucky Kuji Online is down for that check, not for Arara.
Should I add 2.20 million to the ARARA 81.3 million?
No. The platform total already covers client lists. SEGA is catalogued as a named client row so the company page is accurate.
When was this found?
Arara told SEGA on 3 November 2026 that newsletter addresses had left. The public SEGA notice is 9 November.
Sourcing note: counts, exclusions, newsletter table and timeline come from SEGA's 9 November 2026 notice. Arara's platform reports are cited for the vendor incident only.