SEGA breach: 2,196,044 newsletter email addresses leaked through email provider Arara, and 92,273 records also included delivery-related information
SEGA said on November 9, 2026 that 2,196,044 email addresses used for some SEGA and SEGA Fave newsletters were leaked after unauthorised access to its email provider Arara, and that 92,273 of those records also included delivery-related information still under investigation; names, login passwords and card details were not leaked.
What happened
SEGA said on November 9, 2026 that email addresses used for some of its newsletters were leaked after a third party gained unauthorised access to “Arara Message,” the email distribution service run by Arara that SEGA and its group company SEGA Fave use to send newsletters about their products and services. SEGA first asked Arara about the safety of the service on October 29 and was told no leak had been confirmed; after Arara publicly disclosed the unauthorised access on November 1, SEGA asked again and Arara notified it on November 3 that the email addresses SEGA had used for its mailings had leaked. The two companies ran further checks from November 5 to 8 before Arara gave SEGA a formal report. This incident is separate from the unauthorised access to SEGA Fave’s arcade network servers, which SEGA has reported separately.
Who is affected
Recipients of 11 SEGA and SEGA Fave newsletters sent between July 2 and October 28, 2026 — the CHUNITHM Mate launch announcement, six SEGA Lucky Kuji Online release newsletters, the Ongeki Re:Fresh Act.2 launch announcement, two Tokyo Game Show 2026 exhibition announcements and the maimai DX MAGiCAL launch announcement. SEGA counts 2,196,044 email address records leaked; the count is of addresses, not necessarily of individual people. For 92,273 of those records, information associated with the newsletter delivery was also included — SEGA has not said exactly what that information is and says it is still investigating it with Arara. SEGA says the leaked information did not include names, dates of birth, gender, postal addresses, telephone numbers, credit card information or login passwords. Email addresses registered with SEGA Account are not affected, because that service uses a different delivery system.
How serious
No login passwords and no card details were leaked, and SEGA Account was not touched, so this data on its own does not open SEGA accounts. The concrete risk is targeted phishing: an email address paired with the knowledge of which SEGA newsletters a person actually received is enough for a scammer to pose as SEGA, SEGA Fave or Arara with a believable game, lottery or event lure and steer the recipient to a fake page that asks for the passwords or card details this leak did not contain. SEGA says no misuse of the leaked information had been confirmed as of November 9 — that covers only the period since the leak was confirmed, and scam mail using the list could arrive later.
What to do now
Treat unexpected email claiming to come from SEGA, SEGA Fave or Arara with extra care, especially messages about SEGA Lucky Kuji, CHUNITHM, Ongeki, maimai or Tokyo Game Show. Do not open links or attachments in messages you do not recognise and do not reply to them, as SEGA itself advises; go to the official site or app by typing the address yourself instead. SEGA and SEGA Fave never ask for passwords or credit card information by email — delete any message that does and do not follow its links. There is no SEGA password to change for this incident, because SEGA says login passwords were not leaked and SEGA Account uses a separate system. SEGA has suspended newsletters sent through Arara until the leaked information is confirmed and safety is verified, plans a joint report with Arara to Japan’s Personal Information Protection Commission, and says it will contact affected customers individually once the details are confirmed.
Sources: SEGA, “Apology and notice on personal-information leak via contractor” (Japanese), November 9, 2026 · CyberInsider, “SEGA says 2.2 million user email addresses leaked in vendor breach,” November 9, 2026 · AUTOMATON West, “SEGA reports over 2.19 million email addresses were compromised,” November 9, 2026