Sega Data Breach: 2.2 Million Email Addresses Leaked Through Email Vendor Arara, What Is Confirmed and What to Check

Sega says 2,196,044 email addresses from its newsletter lists were taken when attackers broke into Arara, the Japanese company that delivered those emails. If your business hands customer lists to an email or marketing vendor, this breach matters because Arara's count grew from about 3.01 million to more than 81 million addresses in eight days, across up to about 380 client companies.

What happened in the Sega data breach

On November 9, 2026, Sega said that addresses used for some newsletters from Sega and its group company Sega Fave had leaked after a third party accessed Arara's email delivery system. The affected lists cover 11 newsletters sent between July 2 and October 28, 2026: arcade game launch notices, Sega Lucky Kuji sales messages and Tokyo Game Show 2026 notices.

The headline figure of 2.2 million counts email addresses, not confirmed people. Within that total, 92,273 addresses also came with what Sega calls delivery-related information, which it is still investigating with Arara. Sega plans to contact affected customers individually once the details are confirmed.

Sega's timeline is the part every business should read:

• October 29: Sega asked Arara about the safety of these newsletters and was told no leak had been confirmed.
• November 1: After Arara's public disclosure, Sega checked again.
• November 3: Arara notified Sega by email that its addresses had been taken.
• November 5 to 8: The two companies ran further checks, and Arara delivered a formal report.
• November 9: Sega published its notice.

How big is the Arara email breach?

Arara's service, Arara Message, sends email on behalf of companies. Its own reports show the scope widening with each update:

Arara stresses that these are counts of addresses, not people. It breaks the total into 47,044,380 addresses with extra details and 34,285,087 with email only, and says that split is still being checked. The extra details vary by client and can include name, gender, date of birth, phone number, member number and address. Arara says it holds no credit card numbers.

The attackers also abused the service itself. Arara says up to about 7.13 million phishing emails posing as credit card companies went out from news@arara.com between October 28 and 30. It says those messages went to addresses the attacker brought in from outside. Arara Message has been stopped since October 31, with no restart date.

What is confirmed, what is claimed and what is not known

Confirmed by the companies involved:

• Sega's newsletter addresses were taken from Arara's systems.
• Arara's total now stands at 81,329,467 unique addresses, and Arara says counts may still be refined.
• Sega has paused newsletters sent through Arara until safety is verified.

Claimed, and not independently checked in anything we could find:

• Sega says names, birth dates, gender, addresses, phone numbers, card details and login passwords were not in its leaked data.
• Sega says no misuse of the leaked data had been confirmed as of November 9.
• Sega says SEGA Account email addresses are not affected because they use a different delivery system.
• Arara says the attacks appear to come from the same third party, based on common features such as where they originated.

Not known:

• Who carried out the attack.
• How and when the attackers first got in. Arara blames a web server vulnerability and problems in its system environment, but names no product or CVE in the reports we read, and says the entry route is still under investigation.
• What the delivery-related information on Sega's 92,273 addresses contains.
• Whether details of client staff who use Arara's admin screens were exposed. Arara listed this as still being checked on November 2.

One point should not be mixed up with this breach. Sega says Sega Lucky Kuji Online is down for maintenance because of a separate unauthorized access incident on servers for Sega Fave's arcade network service.

Why a vendor email breach matters for your business

This list was exposed on the vendor's system, so strong security on your own network would not have protected it. A mailing list also tells a criminal which brand a person trusts, which makes a fake message easier to write. Where names and member numbers are attached, the fake gets better still. Codes and passwords only help if people do not hand them over, as we covered in Does MFA Stop Stolen Passwords?

The outage is a business problem too. Accounting software vendor TKC listed 19 systems that could not send email while Arara was down. If your password resets, invoices or appointment reminders run through one sender, a vendor's bad week becomes yours. It raises the same question as Who Is Patching the Software That Runs Your Business?

What to do this week: vendor breach checklist

If you are on one of the affected Sega lists, treat unexpected email claiming to be from Sega, Sega Fave or Arara with suspicion. Do not click links, open attachments or reply. If you entered card details on a suspicious page, contact your card issuer right away.

Sega data breach questions people are asking

Was Sega hacked?

The newsletter addresses leaked from Arara's email delivery system, which Sega used as a vendor. Sega separately reports unauthorized access to servers for Sega Fave's arcade network service, and says that is a different incident.

How many people are affected by the Sega data breach?

Sega reports 2,196,044 email addresses. That is not necessarily the same as the number of people, since one person can have more than one address.

Were passwords or credit card numbers stolen from Sega?

Sega says login passwords and credit card information were not included in the leaked data. Arara says it holds no credit card numbers.

What is the Arara breach?

A third party accessed Arara Message, a Japanese email delivery service, and took data from October 28 to 31, 2026. Arara, part of the Paycloud group, reports 81,329,467 unique addresses taken, from up to about 380 client companies.

Is my SEGA Account affected?

Sega says email addresses registered to SEGA Account use a different delivery system and are not part of this leak.

Should businesses outside Japan care?

The notices we read describe a Japanese vendor and do not list clients by country. The lesson applies anywhere: a mailing vendor holds a copy of your customer list, and its security decides how safe that copy is.

The bigger lesson

A vendor's first answer is rarely its final one. Sega was told no leak had been confirmed, then learned otherwise five days later. Arara's total grew more than 25 times over, and on November 6 it corrected the period when data was taken, asking clients to update reports that used the old dates. Treat every early "we are not affected" as provisional, keep less data with vendors, and decide now who gets the call when one of them is breached.

Want your vendors, logins and email setup reviewed? See our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Sega notice, November 9, 2026; Arara first report; Arara second report; Arara third report; Arara statement, November 6; Arara Message incident updates; TKC notice.