← Sega

2026 SEGA — Arara vendor leak; 2.20M newsletter emails

2026 2.2M records affected Share on X

Data compromised

2,196,044 newsletter email addresses. 92,273 of those also have delivery-side accompanying data still under review with Arara. Names, dates of birth, sex, addresses, phones, payment cards and login passwords were not in the take. SEGA Account mailbox addresses sit on a different mailer and are out of scope. No misuse confirmed as of the notice. Lucky kuji online is separately offline for the SEGA Fave arcade-network incident.

Technical writeup

Official SEGA notice 9 Nov 2026. Catalogued as a client row under SEGA, like AIRDO, Solaseed Air, JERA Sunday and Yokohama Rubber. Count is emails, not unique people.

Root cause

SEGA and SEGA Fave used Arara Message for some product newsletters. Arara was reached by a third party. SEGA asked Arara on 29 October and was told no leak. After Arara’s 1 November public notice SEGA asked again. On 3 November Arara said SEGA newsletter addresses had left. Formal report 5-8 November. Official SEGA notice 9 November 2026. Same-week ARARA Message platform incident. Do not add this row into the ARARA 81.3 million unique-email total.

References

Breaches you may like

Sign in to monitor vendor exposures, observe your organization's attack surface and security posture, access timely breach intelligence, provision API credentials, and run external security scans—all within one consolidated, secure workspace.

Log in →