SEGA reports over 2.19 million email addresses were compromised in cyberattack on its third-party provider. SEGA Accounts not affected

SEGA announced on November 9 that user information was leaked following unauthorized access to the company’s email distribution system Arara. This includes email addresses and information associated with SEGA’s newsletter distributions for products and services.

SEGA reports that 2,196,044 email addresses were affected, including 92,273 associated with newsletter distribution. The newsletters in question include the CHUNITHM Mate launch announcement, six SEGA Lucky Kuji Online release newsletters, the ONGEKI Re:Fresh Act.2 launch announcement, two Tokyo Game Show 2026 exhibition announcements, and the Maimai DX MAGiCAL launch announcement.

SEGA is currently conducting a co-investigation with Arara regarding the leaked information. As of the announcement, there have been no reports of cases where the leaked information has been misused. Regardless, SEGA advises those who opted into the above newsletters to be wary of any emails they receive, as the leaked information could allow someone to pose as an affiliate of SEGA or Arara.

It has been confirmed that customer names, dates of birth, genders, residential addresses, telephone numbers, credit card information, and login passwords of the affected emails have NOT been leaked.

It should be worth noting that those with SEGA Accounts (which are used to play many of the company’s games) are not affected, as the service uses a separate email distribution system. Additionally, SEGA Lucky Kuji Online services are still undergoing maintenance following last week’s SEGA Fave server breach.

SEGA is postponing the distribution of email newsletters using Arara’s email distribution center until the investigation is complete. Following the investigation, Arara has proposed a joint report to Japan’s Personal Information Protection Commission. SEGA also plans to individually contact each affected person once the details of the leaked information have been confirmed.

Moving forward, SEGA states it will “strengthen and reinforce its information management systems, including the handling of personal information entrusted to external service providers.”

Related:

SEGA still has no timeline for restoring arcade network services four days following server breach. Next update set for November 8

Capcom reports large-scale data breach affecting approximately 11.77 million “Capcom ID” accounts. No credit card information compromised