SEGA newsletter data breach exposes 2.2 million email addresses

Japanese gaming giant SEGA has disclosed a data breach at its third-party newsletter provider, ARARA, that exposed newsletter subscriber email addresses. BleepingComputer's report by Bill Toulas, published November 9, 2026, at 05:09 PM, gives SEGA's figures and the dates of ARARA's notices to the company. The breach sits on ARARA's email distribution service, which handles those SEGA newsletters.

This account is for subscribers to SEGA and SEGA Fave newsletters and for anyone who holds a SEGA Account. It records how many addresses SEGA says were exposed, which personal fields the investigation excluded, and why mail tied to a SEGA Account sits on a different system. It also records ARARA's client-wide totals, the late-October impersonation mail, the other named victims, and the arcade-network outage SEGA says is unrelated.

012.2 million newsletter email addresses

The exposed set includes 92,300 records with additional information SEGA says is yet to be determined. SEGA puts the exposed email addresses at 2.2 million newsletter subscribers. Those addresses come from 11 newsletters linked to SEGA and SEGA Fave products and services.

The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords. Email addresses registered with a "SEGA Account" are handled by a separate distribution system and were not affected by this incident. "We are currently investigating the information associated with newsletter distribution in cooperation with ARARA," SEGA stated.

The company is working with ARARA to determine what newsletter data was exposed. SEGA says it has no confirmed evidence of misuse. Bill Toulas's November 9, 2026 report carries that statement, along with ARARA's sharing of the full details between November 5 and 8.

02ARARA's 77 million address breach

On November 2, ARARA disclosed a massive breach affecting its email distribution service, the channel it runs for corporate clients. The company said that breach compromised 77 million email addresses from nearly 380 of those clients. SEGA is one of the clients whose newsletter addresses were in the exposed set.

According to ARARA, a web server vulnerability and problems in its system environment contributed to the incident that hit the email distribution service. The exact intrusion method remains under investigation, and so does the timing of the intrusion. The vulnerability and the system-environment problems are the factors ARARA has named so far.

03October 29 assurance and impersonation mail

ARARA previously estimated a smaller impact and assured SEGA on October 29 that no data compromise had occurred. On November 3, after uncovering the full extent of the incident, ARARA notified the gaming company that data had been exposed. It shared the full details between November 5 and 8.

ARARA also said the attackers abused their access to its service to send over 7 million emails impersonating credit card companies in late October. Those messages went out through the email distribution service the attackers had accessed. ARARA placed the sending in late October, before its November 2 disclosure and the November 3 notice to SEGA.

SEGA says it has no confirmed evidence of misuse in the disclosure that describes the newsletter exposure. The 7 million impersonation emails are ARARA's separate description of how attackers used the breached service. The disclosure does not say those credit-card messages went out under SEGA's name.

04MOS Burger, Shochiku, TKC, IIJmio

The same incident exposed 7.5 million email addresses at MOS Burger, one of the other notable victims. Shochiku Multiplex Theatres is listed with 3.3 million records. TKC is listed with 2.3 million email addresses, and IIJmio with nearly 1 million email addresses.

The published totals do not use one unit for every organization. Shochiku Multiplex Theatres is given as 3.3 million records, while MOS Burger, TKC, and IIJmio are given as email-address totals of 7.5 million, 2.3 million, and nearly 1 million. SEGA's own newsletter exposure is also an email-address count, 2.2 million, plus 92,300 records whose additional information is yet to be determined.

ARARA's breach compromised 77 million email addresses from nearly 380 corporate clients. MOS Burger, Shochiku Multiplex Theatres, TKC, and IIJmio are the other notable victims named for that same incident. The account does not publish the rest of the client list.

05ALL.Net and Aime still offline

On November 2, SEGA FAVE, SEGA's subsidiary responsible for toys, electronic gadgets, and arcade machine operations, disclosed unauthorized access to servers supporting its ALL.Net and Aime arcade gaming network services. SEGA Fave's arcade game network services are still offline, undergoing maintenance and safety checks, after that separate cybersecurity incident last week. SEGA noted that this outage and the newsletter breach are unrelated.

In response, SEGA FAVE suspended all related services, including online gameplay, SEGA Lucky Kuji Online, and new SEGA ID registrations. Its initial investigation found no evidence of customer or business partner data exfiltration. Payment information was unaffected because it was stored separately.

Both notices landed on November 2: ARARA's disclosure of the email-distribution breach, and SEGA FAVE's disclosure of unauthorized access to ALL.Net and Aime servers. SEGA's statement treats the two incidents as unrelated. The arcade services remained offline for maintenance and safety checks when the newsletter disclosure was reported on November 9, 2026.