Sega Breach Exposes 2.2 Million Emails in Supply-Chain Attack

What happened at Sega?

Sega disclosed that a third-party marketing platform, Arara Message, was compromised in early November 2026, exposing email addresses used for newsletters.

Sega has confirmed that 2,196,044 email addresses were exposed after a cyberattack on Arara, the company that runs its email newsletter distribution. An additional 92,273 records related to email distribution were also compromised, according to a short notice on Sega's website.

The breach did not expose names, dates of birth, gender, addresses, phone numbers, credit card information, or login passwords, Sega said. Email addresses registered with a SEGA Account use a different system and were not affected.

Sega warned customers about potential phishing emails and said it has not confirmed any misuse of the leaked data so far. The company is still investigating the full scope of the incident.

The bigger picture: a supply-chain attack on Arara

Sega is just one of hundreds of companies caught up in a massive breach at Arara, a Japanese digital marketing firm.

Arara reported in early November that attackers exploited a web server vulnerability and other system weaknesses to access 97 servers storing data for up to 380 corporate customers. More than 81 million email addresses were exposed, along with names, dates of birth, phone numbers, postal addresses, and membership numbers for some individuals.

The attackers also compromised a separate environment containing 3.38 million more email addresses and over 400,000 customer records with personal information. They then sent more than seven million phishing emails spoofing credit card companies, forcing Arara to temporarily shut down its service on October 31, 2026.

Other victims include travel booking site Asoview (15.82 million records), electronics retailer Bic Camera (15.2 million), fast-food chain MOS Burger (7.5 million email addresses), and cinema operator Shochiku Multiplex Theaters (3.3 million). Sega and its subsidiary Sega Fave reported approximately 2.2 million affected addresses.

Sega's second security incident this month

The Arara breach is separate from another incident that took Sega Fave's arcade network services offline.

On November 2, Sega Fave said an unidentified threat actor accessed servers supporting its ALL.Net and Aime arcade gaming network services. Online gameplay, Sega Lucky Kuji Online, and new Sega ID registrations were taken offline for investigation. According to BleepingComputer, those services are still unavailable as Sega works on maintenance and safety checks.

Sega stressed that the two incidents are unrelated. No threat actor has claimed responsibility for either breach.

What it means for you

If you've signed up for a Sega newsletter—whether for games, merchandise, or Sega Fave arcade updates—your email address may be among the 2.2 million exposed. Sega says no passwords or payment details were leaked, so you don't need to change your SEGA Account password. But expect phishing attempts: Arara's attackers already sent millions of fake emails pretending to be credit card companies.

Be cautious with any email claiming to be from Sega or Arara. Don't click links or download attachments unless you're certain of the sender. Sega has not announced any compensation or credit monitoring for affected users.

Sega's email leak is a textbook supply-chain breach: the gaming giant's own systems weren't hit, but its customers' inboxes are now in the hands of attackers. With Arara's service still recovering and phishing emails already circulating, the next few weeks will test how well Sega and its customers handle the fallout.