Sega said 92,273 records also included information associated with newsletter delivery, while SEGA Account addresses were outside the leak. It has suspended newsletters sent through provider Arara.
Sega said on 9 November that 2.2 million newsletter recipients’ email addresses leaked after an unauthorized third party accessed Arara Message, a service run by Japanese email distributor Arara. Sega uses the service for some newsletters about its own products and those of its group company Sega Fave.
Of those records, 92,273 also contained information associated with newsletter delivery, which Sega and Arara were still investigating. Sega said email addresses registered with SEGA Account were outside the leak because they use a different distribution system.
Sega listed the affected 2026 distributions as the CHUNITHM Mate launch announcement on 2 July; Sega Lucky Kuji Online sales information on 6 and 13 July, 7 September and 21 and 28 October; the Ongeki Re:Fresh Act.2 launch announcement on 23 July; Sega Lucky Kuji sales information on 4 September; Tokyo Game Show 2026 exhibition information on 17 and 18 September; and the maimai DX MAGiCAL launch announcement on 17 September.
In its disclosure, Sega said the leaked information did not include names, birth dates, genders, addresses, phone numbers, credit card information or login passwords. It said no misuse of the information had been confirmed at the time of the announcement.
Sega warned that suspicious messages could impersonate Sega, Sega Fave or Arara, or use the names of their products and services. It asked recipients not to open links or attachments in unexpected emails or reply to them.
The company said neither Sega nor Sega Fave asks customers for passwords or credit card information by email. It advised recipients to delete messages asking for those details without replying or following links.
A Microsoft support-forum moderator says the company has classified the delivery problem as a service degradation and is investigating its cause.
Sega said Arara told it on 29 October that no leak had been confirmed when Sega asked about newsletter security. After Arara disclosed unauthorized access on 1 November, Sega checked again. Arara confirmed the address leak by email on 3 November; further checks and a formal report followed on 5–8 November.
Sega said Arara was investigating the cause and working to prevent further damage, while the companies checked the leaked information and the scope of the impact. Sega plans to contact affected customers individually once the details are confirmed and to publish further material findings. A joint report to Japan’s Personal Information Protection Commission is also planned through Arara.
Newsletter delivery through Arara will remain suspended until the leaked information has been checked and safety confirmed, Sega said.
2 min
NVIDIA says the model averaged 71% success across 50 tasks with one demonstration per task and 95% with five, as partners test it for laundry handling, manufacturing and other work.
3 min
Russia’s Emergency Situations Ministry said villages and towns remained without electricity after severe weather. Officials expected repairs to finish around 20:00 Moscow time (21:00 Yerevan time) on 9 November.
1 min
