SEGA newsletter data breach exposes 2.2 million email addresses - BleepingComputer
Japanese gaming giant SEGA has revealed that a data breach at its newsletter provider ARARA exposed 2.2 million email addresses of subscribers.
The exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services. The company confirmed that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords.
Email addresses registered with a "SEGA Account" are handled by a separate distribution system and were not affected by this incident. SEGA is working with ARARA to determine what data was exposed and has no confirmed evidence of misuse.
ARARA service breached
ARARA disclosed on November 2 that it suffered a massive breach affecting its email distribution service, which compromised 77 million email addresses from nearly 380 corporate clients. A web server vulnerability and problems in its system environment contributed to the incident.
We are currently investigating the information associated with newsletter distribution in cooperation with ARARA
ARARA previously estimated a smaller impact and assured SEGA on October 29 that no data compromise had occurred. However, on November 3, after uncovering the full extent of the incident, ARARA notified SEGA that data had been exposed.
Other victims affected
Notable victims of the same ARARA breach include MOS Burger with 7.5 million email addresses exposed, Shochiku Multiplex Theatres with 3.3 million records, TKC with 2.3 million email addresses, and IIJmio with nearly 1 million email addresses.
ARARA also confirmed that attackers abused their access to send over 7 million emails impersonating credit card companies in late October.
SEGA Arcade still down
SEGA Fave's arcade game network services, which suffered a separate cybersecurity incident last week, are still undergoing maintenance and safety checks. On November 2, SEGA FAVE disclosed unauthorized access to servers supporting its ALL.Net and Aime arcade gaming network services.
The company suspended all related services including online gameplay, SEGA Lucky Kuji Online, and new SEGA ID registrations. SEGA noted that the two incidents are unrelated.
Related
