SEGA says 2.2 million newsletter email addresses leaked through mail provider Arara

SEGA is the latest company to confirm that its customers are caught up in the breach at Arara, the Japanese email delivery company behind “Arara Message.” In a notice posted on November 9, 2026, SEGA says email addresses used for some newsletters about SEGA and SEGA Fave products and services were taken. It counts 2,196,044 email addresses, of which 92,273 also came with additional delivery-related information that SEGA and Arara are still examining.

What was and wasn’t taken

SEGA says the leaked data is email addresses plus information attached to newsletter delivery. It says the following were not included: names, dates of birth, gender, addresses, phone numbers, credit card information and login passwords. Email addresses registered to a SEGA Account go through a different delivery system and are not part of this incident. SEGA says it hasn’t seen the leaked data misused so far.

The newsletters involved include announcements for SEGA arcade games such as maimai, CHUNITHM and ONGEKI. BleepingComputer counts 11 affected newsletters.

Timeline

SEGA’s notice is unusually candid about how it found out:

• October 29: as part of its own security checks, SEGA asked Arara whether its newsletter data was safe and was told no leak had been confirmed.
• November 1: after Arara publicly announced unauthorized access, SEGA checked again.
• November 3: Arara emailed SEGA to say the email addresses SEGA used had been leaked. SEGA asked for more detail right away.
• November 5 to 8: the two companies did further checks and Arara sent a formal report.

SEGA says it will report to Japan’s Personal Information Protection Commission jointly with Arara, contact affected customers individually once the details are confirmed, and pause newsletters sent through Arara until their safety is confirmed.

How this fits the Arara breach

Arara said on November 2 that about 77 million email addresses from hundreds of corporate clients were taken from its service, as we covered in Arara now says about 77 million email addresses were taken. Client companies have been publishing their own counts since, including Asoview and others. SEGA’s notice says its leak stems from that same unauthorized access to Arara Message; it is one client’s share of the incident, not a separate breach.

Separately, SEGA Fave disclosed unauthorized access to servers behind its ALL.Net and Aime arcade network services on November 2. SEGA says that incident is unrelated, and SEGA Lucky Kuji Online is down for maintenance as part of those safety checks.

What this means for you

If you subscribed to a SEGA or SEGA Fave newsletter, your email address may be on a list in criminal hands, linked to the fact that you’re a SEGA fan. That’s useful for phishing. SEGA warns that fake emails may pretend to come from SEGA, SEGA Fave or their products, and also from Arara itself. Arara has already said its system was abused to send fake credit card company emails in late October.

What you can do

1. Treat SEGA-themed emails with care, especially anything about prizes, lottery tickets, account problems or payments. Go to SEGA’s site by typing the address yourself.
2. Never send a password or card number by email. SEGA says it and SEGA Fave will never ask for them that way.
3. Don’t open attachments or links in unexpected emails, and don’t reply to them.
4. Be wary of emails claiming to be from Arara, which SEGA also warns about.
5. Use a separate address or alias for newsletters, so a leak like this can’t be tied to your main inbox.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases let you give newsletters their own address, so you can turn one off if it leaks. Frame never collects or stores the leaked records themselves.

Related coverage

• Arara now says about 77 million email addresses were taken: the breach at the email provider behind SEGA’s newsletters.
• Arara breach: Asoview and other client companies name their counts: earlier client disclosures from the same breach.
• Capcom says 11,774,247 CAPCOM ID email records were copied: a separate breach at another Japanese game company.

Sources

• SEGA, 業務委託企業への不正アクセスによる個人情報流出に関するお詫びとお知らせ (in Japanese), November 9, 2026
• BleepingComputer, SEGA newsletter data breach exposes 2.2 million email addresses, November 2026