Sega has confirmed that 2.2 million customer email addresses were exposed after hackers breached Arara Inc., a Japanese email delivery provider the company uses for newsletters. The attack occurred on October 28, 2026, when an unauthorized party exploited vulnerabilities in Arara’s web servers. Arara suspended its distribution service on October 31.
The leaked data is limited to email addresses. No names, passwords, credit card details, or other personal information were compromised. No misuse has been confirmed yet, but Sega is urging customers to delete any suspicious emails claiming to be from Sega or its subsidiary Sega Fave, and never click unknown links or attachments.
Arara’s parent, Paycloud Holdings, first estimated on November 2 that up to 77 million addresses from around 380 client companies may have been taken, some with names and phone numbers. Paycloud has since revised that to about 3.4 million unique addresses across 61 companies. The attacker also used the hijacked service to send millions of phishing emails.
Source: Infosecurity Magazine
