SEGA has confirmed a data breach affecting more than two million email addresses after attackers broke into Arara Message, the third-party service it uses to send newsletters. The Japanese games company disclosed the incident on 9 November 2026.

According to Cyber Security News, a total of 2,196,044 email addresses were exposed. The addresses belonged to people who received promotional emails for SEGA and its group company SEGA Fave. A further 92,273 of those records also included information linked to newsletter delivery, and SEGA said it was still checking what that additional information contained.

The company stressed that the exposed data did not include customer names, dates of birth, gender, home addresses, phone numbers, credit card details or login passwords. Email addresses registered with a SEGA Account were also unaffected, because that service uses a different email distribution system.

How the breach unfolded

The affected newsletters were sent between 2 July and 28 October 2026. They covered titles including CHUNITHM Mate, Ongeki Re:Fresh Act.2, maimai Deluxe MAGiCAL and Sega Lucky Draw, as well as announcements for Tokyo Game Show 2026.

SEGA first contacted Arara on 29 October during a security review and was initially told that no information leak had been confirmed. Arara notified SEGA on 3 November that email addresses used for its newsletters had leaked, and further checks between 5 and 8 November produced an official report.

Arara said attackers exploited a web server vulnerability. It also corrected its earlier timeline, confirming that data theft continued from 28 October until the service was stopped on 31 October. Arara suspended its services at 14:50 on 31 October.

What happens next

SEGA has suspended newsletters sent through Arara pending security checks. It plans to file a joint report with Japan’s Personal Information Protection Commission and to contact affected customers once the details are confirmed.

The company warned that criminals could use the leaked addresses to send messages pretending to represent SEGA, SEGA Fave or Arara. It said neither SEGA nor SEGA Fave requests passwords or credit card information by email, and customers should treat any such request with suspicion.

SEGA also clarified that maintenance affecting Sega Lucky Draw Online follows a separate incident involving SEGA Fave’s arcade network servers, and the two events should not be treated as one confirmed breach. As reported by GBHackers, SEGA had not confirmed any misuse of the exposed information at the time of its announcement, and it plans stronger controls over outsourced data.

The incident is a reminder that a breach at a supplier can expose a company’s customers even when the company’s own systems are not directly attacked.