Sega newsletter data breach sees 2.2 million email addresses exposed — gaming giant says it is investigating, but user financial data not affected

SEGA breach is part of a much larger supply chain attack

by · TechRadar

News By Sead Fadilpašić Published 10 November 2026

(Image credit: Shutterstock)

Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter

  • Sega disclosed a third-party breach that exposed nearly 2.2 million customer email addresses through a marketing service provider
  • Around 92,000 additional records related to email distribution were also compromised in the incident
  • Sega and its provider warned users about phishing risks, though no misuse of the leaked data has been confirmed

Gaming giant Sega has disclosed suffering a third-party cybersecurity incident that exposed email addresses of almost 2.2 million people, as well as other details of at least 92,000.

The company is now investigating deeper, to confirm the details of the leaked information.

What happened

Sega is one of many Japanese companies using the services of Arara, a technology firm providing digital marketing and customer engagement services.

Latest Videos FromTechRadarWatch full video here:

One of its services is called Arara Message, an email distribution platform that businesses can use to send newsletters and other communications to millions of people. This also means Arara was managing contact information on behalf of those organizations, including email addresses, names, and often phone numbers and membership details.

In early November 2026, Arara reported its email distribution infrastructure suffering a compromise. Apparently, a combination of a web server vulnerability and “other system weaknesses” allowed unidentified threat actors to access 97 servers that stored data of up to 380 corporate customers.

The attackers accessed (and most likely exfiltrated) more than 81 million email addresses, together with people’s names, dates of birth, phone numbers, postal addresses, and membership numbers. Not every customer had all of this data exposed - it varied from person to person.

In a subsequent report, Arara added that the attackers compromised a separate environment containing additional 3.38 million email addresses and more than 400,000 customer records containing PII. They ended up sending more than seven million phishing emails spoofing various credit card companies, forcing the company to temporarily shut down the service on October 31 2026.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors