SEGA has disclosed that a breach at ARARA, the Japanese company that sends some of its email newsletters, exposed the email addresses of 2,196,044 subscribers. In a notice dated November 9, SEGA says 92,273 of those records also contain “information accompanying the delivery” that is still being investigated. SEGA says the leaked data does not include names, dates of birth, gender, addresses, phone numbers, credit card information or login passwords, and that it has no confirmation that the data has been misused. Email addresses registered to a “SEGA Account” use a separate delivery system and were not affected.
The notice lists 11 newsletters sent between July 2 and October 28, 2026, covering arcade titles such as CHUNITHM, ONGEKI and maimai, SEGA Lucky Kuji (prize lottery) sales announcements and Tokyo Game Show 2026 exhibit information. According to SEGA’s timeline, ARARA told it on October 29 that no information had leaked, then notified it on November 3 that email addresses had been exposed, and sent formal details between November 5 and 8. SEGA has paused newsletters sent through ARARA’s system until it can confirm they are safe.
SEGA is one of many ARARA customers. BleepingComputer reports that ARARA has said the breach affected about 77 million email addresses across nearly 380 corporate clients, that a web server vulnerability and problems in its system environment contributed to it, and that attackers used the access to send more than 7 million emails impersonating credit card companies in late October. BleepingComputer also lists other victims: MOS Burger (7.5 million addresses), Shochiku Multiplex Theatres (3.3 million), TKC (2.3 million) and IIJmio. IIJ’s own notice puts IIJmio at 983,458 addresses, including cancelled subscribers, and also warns of impersonation emails. SEGA says this is separate from the unauthorized access to SEGA Fave’s arcade network servers that it disclosed on November 2.
How to check if you’re affected
Affected products are the SEGA and SEGA Fave email newsletters listed in SEGA’s notice, so you may be affected if you subscribed to any of them, including the Lucky Kuji Online and Tokyo Game Show 2026 mailings. SEGA says it will contact affected customers individually once the details are confirmed.
- Be cautious with any email that claims to come from SEGA, SEGA Fave, their products and services, or ARARA. SEGA asks you not to open links or attachments in suspicious email and not to reply to it.
- SEGA says neither SEGA nor SEGA Fave will ever ask for your password or credit card information by email. If an email does, delete it without clicking.
- If you subscribed to newsletters from other ARARA customers, such as IIJmio, the same caution is sensible for messages that appear to come from them (our suggestion; IIJ’s notice gives the same warning for its own customers).
Sources
- SEGA: Apology and notice regarding personal information leaked through a contractor (Japanese)
- IIJ: Leak of customer information from the email delivery service we use (Japanese)
- BleepingComputer: SEGA newsletter data breach exposes 2.2 million email addresses
- ARARA’s November 2 notice (PDF) is linked from the BleepingComputer article but was not read directly; ARARA’s figures above are as reported by BleepingComputer.