SEGA Reports Leak of More Than 2.19 Million Email Addresses After Cyberattack on Third-Party Contractor

SEGA said more than 2.19 million email addresses were exposed after unauthorized access to a mailing system operated by Arara, a third-party service provider the Japanese company works with. Sensitive personal data was reportedly not affected.

Attackers gained access to the Arara system, which SEGA used to send informational and promotional emails about its products and services. The incident affected 2,196,044 email addresses in total, including 92,273 used to subscribe to various SEGA mailing lists.

The affected mailings included launch announcements for CHUNITHM Mate, ONGEKI Re:Fresh Act.2 and Maimai DX MAGiCAL, six newsletters about new SEGA Lucky Kuji Online releases, and two messages about the company’s participation in Tokyo Game Show 2026.

SEGA and Arara are investigating the incident to determine the full extent of the leak and the circumstances of the unauthorized access. SEGA said it is not currently aware of any misuse of the stolen information.

SEGA urged users to be cautious when receiving emails, warning that the exposed addresses could be used for phishing attacks and messages impersonating SEGA or Arara.

Source: iXBT.games