SEGA confirms 2.2 million emails leaked in Arara breach

SEGA confirmed on 9 November 2026 that unauthorised access to Arara Message, the email delivery service run by its contractor Arara, exposed 2,196,044 email addresses from SEGA and SEGA Fave newsletters. Arara's third incident report of 6 November 2026 put the platform-wide total at 81,329,467 deduplicated email addresses across up to about 380 client companies. SEGA's figure forms part of that platform total. Arara Message stored the mailing lists of many client companies on shared infrastructure, so the SEGA count does not add to the total. The service has been shut down since 31 October 2026, and Arara has announced no restart date.

The SEGA disclosure#

SEGA's notice of 9 November 2026 covers email addresses used to send newsletters about SEGA and SEGA Fave products and services. Of the 2,196,044 addresses, 92,273 records also held information related to newsletter distribution. SEGA states that the contents of that additional information are still being checked with Arara. The count is of email address records. One person can hold several addresses, so the figure is not a count of individuals.

The notice also sets out what the SEGA records did not contain. Names, dates of birth, gender, postal addresses, telephone numbers, credit card details and login passwords were absent, and addresses registered with SEGA Account fall outside the breach because that service uses a different delivery system. SEGA states that no misuse of the exposed information had been confirmed as of 9 November 2026. Cyber Insider and GameSpark both reported the disclosure on 9 November 2026, with the same count and the same exclusions.

The affected mailings#

Eleven newsletters are covered by the leak. SEGA's notice lists each one, sent between 2 July and 28 October 2026, with its sending date.

Arcade game releases, Lucky Kuji lottery products and the Tokyo Game Show 2026 presence are the subjects of the mailings. SEGA will contact affected customers individually when the details of the exposed information are confirmed, according to the notice.

Disclosure chronology#

SEGA first raised the question before Arara had confirmed any leak. On 29 October 2026, during checks on its security environment, SEGA asked Arara to verify the safety of the newsletter distribution. Arara replied that no information leak had been confirmed. Arara disclosed the unauthorised access publicly on 1 November 2026. SEGA asked for another check. On 3 November 2026, Arara notified SEGA by email that addresses used for its mailings had leaked externally. Checks continued between 5 and 8 November 2026. During that period SEGA received a formal report from Arara. SEGA published its notice on 9 November.

Newsletters sent through Arara remain suspended while SEGA verifies the exposed information and completes safety checks. The company plans to file a joint report with Arara to Japan's Personal Information Protection Commission, and it states that it will update its notice if new facts that should be made public come to light.

The Arara platform total#

SEGA is one client company in a much larger platform incident. Arara's third report of 6 November 2026, issued through its parent Paycloud Holdings, put the platform-wide total at 81,329,467 deduplicated email addresses. The figure counts email addresses, not people. Arara states that the count is still being examined, and the incident affected 97 servers and up to about 380 client companies. The same figures appear in Paycloud's third-report filing of 6 November 2026.

The third report splits the total into three parts. Unauthorised access via the Arara Message service accounts for 78,102,937 addresses, while the shared environment first disclosed on 29 October accounts for 2,842,400. A cloud environment identified in the third report, accessed between 28 and 31 October 2026, accounts for 3,249,492. The shared-environment figure was revised down from 3,386,187 in the second report. Added together, the three parts exceed the deduplicated total, because the total removes overlap between the three categories, so the parts cannot simply be added together.

Arara also splits the total by the data attached to each address. Its third report lists 34,285,087 addresses in the email-only category. A further 47,044,380 addresses carry additional attributes, as reported by Newsflayer. The attributes vary by client company. Names, gender, dates of birth, telephone numbers, membership numbers and addresses can all appear. Arara states that the service holds no credit card numbers. Other clients have published their own counts inside the same platform total. The Bic Camera group reported about 14.9 million records, Asoview 15,821,184 member records, and Workman up to about 1,450,000 email addresses. TSN Media lists these client disclosures alongside the SEGA and third-report figures.

The earlier AliasFleet article on this incident, Arara Message breach leaks about 77 million emails, covered the second report of 2 November 2026. The third report raised the total from about 77 million to 81,329,467 and added the newly identified cloud environment.

Phishing emails from the service#

The incident also involved phishing emails sent through the service. Arara reported that up to about 7.13 million emails impersonating credit-card companies were sent from news@arara.com between 28 and 30 October 2026. Subject lines asked recipients to confirm card usage or review billing statements. The messages went to addresses the attacker brought in from outside, not to the client companies' mailing lists. The 7.13 million figure is therefore a count of emails sent, and it is not part of the 81,329,467 leaked addresses.

These phishing emails are the only confirmed abuse of the incident so far. They came from the service's own sending address, news@arara.com, an address recipients had reason to associate with legitimate mail from the platform. Arara advises anyone who received such an email to delete it without opening its links. Anyone who entered card details through one of the messages should contact their card issuer straight away. The guide on how to check if an email is phishing covers the checks that apply to messages of this kind.

SEGA's notice carries the same warning in its own terms. It states that SEGA and SEGA Fave never ask for passwords or credit card information by email, and recipients should not open links or attachments in unexpected emails or reply to them.

The separate SEGA Fave incident#

SEGA's notice draws a line between the Arara breach and a separate intrusion in SEGA Fave's arcade infrastructure. The arcade intrusion forced SEGA Fave to suspend its ALL.Net and Aime network services on 1 November 2026. According to SEGA, no personal information was compromised in the arcade server intrusion. The two incidents are separate matters, and SEGA Lucky Kuji Online remains under maintenance as part of safety checks for the arcade intrusion rather than the Arara breach. Neither the victim counts nor the attacks should be combined.

Measures for affected recipients#

SEGA advises recipients of the affected newsletters to treat unexpected emails claiming to come from SEGA, SEGA Fave or Arara with care. Links and attachments in unexpected emails should not be opened. Such emails should not be answered. Messages that ask for passwords or credit card information should be deleted. The company states that it never asks for either by email. The same advice applies to messages claiming to come from Arara, which states that it never asks for passwords or card details by email.

Arara's advice covers the phishing messages directly.

Recipients can check whether their address appears in known breaches through Have I Been Pwned, which records breaches by email address. The guide on what to do when your email is in a data breach covers the steps after a confirmed exposure. The guide on how phishing uses your leaked email explains how a leaked address and a brand name combine into a convincing phishing message.

The SEGA records contained no passwords, so there is no SEGA password to reset. Anyone who used the same password for another account registered with the leaked address should change the password on that account.

Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.

AliasFleet and newsletter signups#

A newsletter signup hands an email address to a company. The company may hand it on to a delivery provider such as Arara. The subscriber has no way to see that chain. The leak shows what follows when the provider is compromised: the address reaches attackers together with the name of the brand the recipient trusts. AliasFleet provides a separate email alias for each website or service. A newsletter signup then uses an address that belongs only to that service. If that alias appears in a breach, the leak is traceable to the service it was given to, as explained in the guide on which website leaked my email, and the alias can be paused or deleted without changing the address used anywhere else. AliasFleet does not prevent a delivery provider from being breached. It does not remove an address from a list that has already leaked.

Unresolved points#

Arara stopped the Arara Message service on 31 October 2026. No restart date has been announced. Resumption depends on identifying the intrusion route, changing credentials, and confirming system safety through an external specialist. Client companies have been asked to reset administrative passwords and API keys. Arara reported the incident to Japan's Personal Information Protection Commission, the police and JIPDEC on 29 October 2026, while the entry point of the intrusion has not been confirmed by Arara or SEGA. No CVE has been named in any primary notice. A thecybersecguru analysis has linked the intrusion to PHP2Shell vulnerabilities disclosed on 21 October, but that attribution is unconfirmed and neither company has endorsed it, so it is stated here only as an unconfirmed third-party claim. The final platform total is also still open. Arara states that the count is still being examined and that further reports will follow. Until those reports appear, the 81,329,467 figure is the latest confirmed total, dated 6 November 2026. SEGA's 2,196,044 is the latest confirmed client count within it.