SEGA Newsletter Breach at ARARA Exposes 2.2 Million Email Addresses

SEGA has confirmed that a breach at ARARA, the Japanese company that delivered its newsletters, exposed 2,196,044 subscriber email addresses. The intrusion did not touch SEGA's own systems. The attacker went through ARARA Message, a hosted email delivery service used by hundreds of Japanese brands, and then used that service's own sending infrastructure to push millions of phishing emails.

For senders, this is the scenario every vendor risk review is meant to prevent: your list is only as safe as the platform that sends to it. SEGA did nothing wrong in its own stack, yet 2.2 million of its subscribers now sit in a stolen dataset and can expect better-targeted phishing.

What SEGA disclosed

In its notice of 9 November, SEGA says the leaked addresses belong to people who received 11 newsletters sent through ARARA between 2 July and 28 October 2026. The mailings covered arcade titles such as CHUNITHM, ONGEKI and maimai, the SEGA Lucky Kuji prize campaigns and Tokyo Game Show 2026. Addresses tied to SEGA Account are not affected, because that service uses a different delivery system.

SEGA states that it has found no misuse of the data so far. It has suspended every newsletter sent through ARARA, will notify affected customers individually and will report the incident jointly with ARARA to Japan's Personal Information Protection Commission.

The timeline shows how a customer learns about a vendor breach. SEGA asked ARARA about the safety of its system on 29 October and was told no leak had been confirmed. ARARA made the intrusion public on 1 November, then confirmed on 3 November that SEGA's newsletter addresses were part of the stolen data. The two companies spent 5 to 8 November checking the scope before SEGA went public.

What happened at ARARA

ARARA's second incident report describes two intrusions. Probing of a shared environment started on 27 October, and the attacker reached an administration panel on 28 October. A second intrusion ran from 28 to 31 October through the data links that connect ARARA Message to its clients' systems. ARARA attributes the breach to a web server vulnerability combined with weaknesses in the system environment, and says the exact method is still under investigation.

The scale goes far beyond SEGA. ARARA counts about 380 client companies and roughly 77 million addresses reachable through those data links, a figure it says is still under review and is not a count of unique people. A separate shared environment held 3,386,187 addresses for 61 companies. Depending on the client, the stolen member records can include names, dates of birth, phone numbers and postal addresses. ARARA says it does not store card numbers.

The delivery platform was used to send phishing

The detail that matters most for email teams: according to ARARA, up to about 7.13 million phishing emails impersonating a credit card company were sent between 28 and 30 October from an ARARA address, news@arara.com. The attacker did not only take the lists. It used a legitimate, authenticated sending platform to reach people, which is exactly the kind of mail that passes SPF and DKIM and lands in the inbox.

ARARA stopped all of its services on the evening of 31 October and had not announced a restart date in that report.

Action checklist

• Map every vendor that holds your list: ESP, transactional provider, CRM, survey tools and agencies, with who can export it.
• Share the minimum data: if a platform only sends newsletters, it does not need birth dates, phone numbers or postal addresses.
• Ask for breach terms in writing: a notification deadline, a named contact and the right to an incident report, since SEGA first heard "no leak confirmed".
• Send from your own authenticated domain: a dedicated subdomain with SPF, DKIM and a DMARC policy you control, so mail sent in your name is traceable in your DMARC reports.
• Prepare a breach message in advance: what subscribers should expect from you, what you will never ask for, and how to report a fake.
• Watch for lookalike campaigns after a vendor incident and warn subscribers early, as SEGA did about emails posing as SEGA, SEGA FAVE or ARARA.

A separate SEGA incident

SEGA also reported an unrelated breach on 2 November affecting the ALL.Net and Aime networks used by its arcade games, which is why Lucky Kuji Online was placed in maintenance. SEGA says the two incidents are not connected. Subscribers who received both notices should treat them as two separate events.

For subscribers, the advice SEGA gives applies to any leaked list: do not open links or attachments in unexpected messages, do not reply, and delete any email that asks for a password or card number. SEGA says it never requests either by email. Our guide on how to detect phishing emails that pass every check covers the signs to look for when the sender looks legitimate.

Sources

1. SEGA: notice on the leak of newsletter recipients' email addresses, 9 November 2026 (primary source, Japanese)
2. ARARA: second report on unauthorized access to ARARA Message, 2 November 2026 (Japanese, PDF)
3. ARARA: first report on unauthorized access, 29 October 2026 (Japanese)
4. Personal Information Protection Commission, Japan

Related on SMTPedia

• How to detect phishing emails that pass every check
• Email spoofing explained: how it works and how to stop it
• Best transactional email services in 2026