SEGA Confirms Data Breach After Third-Party Email Provider Exposes 2.19 Million Customer Email Addresses - CyberSecurityNews

The company disclosed the breach on November 9, 2026, stating the affected records related to promotional emails for SEGA and its group company, SEGA Fave. The SEGA data breach also exposed information linked to newsletter delivery for 92,273 additional email addresses, though SEGA is still checking what those details contained.

According to SEGA's notice, the leaked data did not include customer names, birth dates, gender, home addresses, phone numbers, credit card details, or login passwords. The company said it had not confirmed any misuse of the exposed information.

Breach Timeline

The affected newsletters were sent between July 2 and October 28, 2026, covering games like CHUNITHM Mate, Ongeki Re: Fresh Act.2, and maimai Deluxe MAGiCAL, as well as Sega Lucky Draw and Tokyo Game Show 2026 announcements.

SEGA contacted Arara on October 29 during a security review and initially received a response stating no information leak had been confirmed. After Arara's November 1 announcement, SEGA conducted further checks.

Arara notified SEGA on November 3 that email addresses used for its newsletters had leaked. Additional checks between November 5 and November 8 led to an official report.

Security Response

In its incident update, Arara said attackers exploited a web server vulnerability. The company also corrected an earlier timeline, confirming that data theft continued from October 28 until the service was stopped on October 31.

SEGA warned that criminals could use the leaked addresses to send messages pretending to represent SEGA, SEGA Fave, Arara, or their products. No such misuse has been confirmed.

SEGA has suspended newsletters sent through Arara pending security checks, plans to file a joint report with Japan's Personal Information Protection Commission, and will contact affected customers once details are confirmed.