Sega Newsletter Emails Exposed After Breach at Third-Party Email Provider

Sega has confirmed that around 2.2 million customer email addresses were exposed through a breach at one of its suppliers. On November 9, the company said an unauthorised third party had gained access to Arara Inc., a Japanese email delivery provider that Sega uses to send its newsletters. Arara said the affected data covers 2.196 million email addresses linked to various newsletters, plus 92,273 items related to distribution.

Arara said it was compromised on October 28, when a hacker exploited vulnerabilities in web servers and reached certain server systems behind its email distribution service. Arara disclosed the incident on October 29 and suspended its Arara Message service on October 31. The service remained offline at the time of reporting. Sega said it is working with Arara and related companies to confirm the details of the leaked information.

The exposed data does not include names, dates of birth, genders, addresses, phone numbers, credit card details or login passwords. No misuse has been confirmed so far. Even so, Sega has warned customers to be alert for suspicious emails claiming to come from Sega or Sega Fave Corporation, or using their product or service names. It advises people not to open links or attachments in emails they do not recognise, and stresses that neither company will ask for passwords or credit card details by email.