Japanese video game company SEGA has disclosed a data breach affecting nearly 2.2 million email addresses after attackers compromised an external service used to distribute promotional newsletters. The incident also affected several other major Japanese businesses that relied on the same email delivery provider.
According to SEGA’s November 9, 2026 announcement, the breach exposed 2,196,044 email addresses associated with newsletters promoting SEGA and SEGA Fave products and services. Of those records, 92,273 also contained additional information related to newsletter distribution, which the company is still investigating.
SEGA confirmed that the compromised data did not include customer names, dates of birth, gender, residential addresses, telephone numbers, credit card details, or account passwords. Email addresses registered directly with SEGA Account were also unaffected because they are managed through a separate system.
The exposure originated at ARARA, a Japanese company that operates the ARARA Message email distribution platform. Attackers gained unauthorized access to the service, compromising information belonging to multiple corporate customers.
ARARA disclosed that the wider incident affected approximately 77 million email addresses associated with nearly 380 organizations. Other affected businesses reportedly include MOS Burger, Shochiku Multiplex Theatres, TKC, and internet service provider IIJmio.
The service provider attributed the incident partly to a vulnerability in a web server and weaknesses in its system configuration. However, investigators have not established the complete intrusion method or precisely when the attackers first gained access.
The attackers also exploited ARARA’s infrastructure to distribute fraudulent emails. More than seven million messages impersonating credit card companies were reportedly sent during late October, demonstrating that the intrusion involved both unauthorized data access and abuse of the email distribution service.
SEGA’s investigation began before the full extent of the incident became clear. On October 29, ARARA initially informed the gaming company that no information exposure had been identified. Following additional investigations, the provider notified SEGA on November 3 that customer email addresses had been compromised.
Further discussions between November 5 and November 8 established the scope of the affected records, leading to SEGA’s public disclosure.
The company said it has not confirmed any misuse of the leaked information associated with its newsletters. Nevertheless, it warned subscribers that criminals could use the exposed addresses to distribute phishing emails impersonating SEGA, SEGA Fave, or their products.
SEGA has suspended newsletters distributed through ARARA until the investigation is complete and the service’s security has been verified. The company also plans to notify affected subscribers individually once the relevant information has been confirmed.
Separately, SEGA Fave recently disclosed unauthorized access to servers supporting its ALL.Net and Aime arcade gaming services. Those systems remain under maintenance and security review, but SEGA stated that the arcade incident is unrelated to the newsletter breach.