SEGA says newsletter vendor breach exposed 2.19 million email addresses

The affected mailings included Tokyo Game Show and arcade game announcements. Sega says its account system was outside the scope of the breach.

Sega disclosed on November 9 that unauthorized access at email vendor Arara exposed 2,196,044 addresses used for Sega and Sega Fave newsletters. For 92,273 of those addresses, information associated with email delivery was also exposed. Sega is still checking what those additional records contained.

The affected mailings went out between July and October. They included updates for CHUNITHM Mate, Ongeki and maimai, plus notices for Tokyo Game Show 2026 and Sega Lucky Lottery. Sega says login passwords and credit card details were outside the exposed data. SEGA Account addresses use a separate mailing system.

Sega said it had found no evidence of misuse as of the disclosure. It plans to notify affected recipients individually once it confirms the details. If an unexpected message claims to be from Sega, Sega Fave or Arara, skip the links and attachments and go directly to the company’s site.