SEGA confirms data breach exposing 2.2M email addresses
Game over? However, this is not a game with continues or extra lives.
SEGA. By Shutterstock
Follow us
- SEGA says a breach at newsletter vendor Arara exposed about 2.2 million customer email addresses.
- The company says the leaked data did not include names, passwords, payment data, or login credentials.
- SEGA warns scammers may use the addresses in phishing emails that look like official SEGA messages.
- SEGA advises customers to avoid suspicious links, attachments, replies, and requests for sensitive information.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Japanese gaming company SEGA has disclosed that a data breach at a third-party newsletter provider exposed approximately 2.2 million email addresses.
On November 2nd, 2026, Arara Inc., a third-party newsletter delivery provider that SEGA uses for its marketing communications, announced that it had suffered a massive data breach between October 28th and 31st, compromising approximately 77 million email addresses from approximately 380 companies.
A vulnerability in Arara’s web server and issues within the company’s system environment contributed to the incident, allowing attackers unauthorized access to 97 of its servers.
These systems stored detailed customer information, including names, gender, shipping addresses, dates of birth, phone numbers, email addresses, and membership numbers.
Arara notified SEGA of the data breach on November 3rd, 2026.
On November 9th, SEGA reported that 2,196,044 customer email addresses were leaked because of unauthorized access at Arara. In addition, 92,273 items containing distribution information were exfiltrated.
SEGA confirmed that the leaked data didn’t contain sensitive personal information such as names, dates of birth, gender, addresses, phone numbers, credit card numbers, or login credentials.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The gaming company warned that scammers could use the leaked email addresses to send phishing messages that appear to be from SEGA. As of writing, there have been no reports of any misuse of the leaked information.
Just to be safe, SEGA recommended that affected customers not open any suspicious URLs or attachments that they may receive, or reply to these messages.
Victims were also warned not to provide sensitive information, such as passwords or credit card details, via email. “If you receive an email containing such content, please do not access the reply or the link provided, and delete it,” the company said. The same goes for emails claiming to be from Arara.
“We take this situation seriously and will work to further strengthen and thoroughly implement our information management system, including personal information related to outsourced work,” SEGA concluded its data breach notice.
The gaming company known for its Sonic franchise promises to investigate the matter with Arara and to notify affected customers as soon as new information becomes available.
