Sega Says 2.2 Million Newsletter Email Addresses Leaked From an Outside Mail Service
Sega Corporation said Nov. 9, 2026, that 2,196,044 email addresses were taken from an outside mail service it hires to send some of its newsletters, and that 92,273 of those addresses also carried information attached to the mailings.
The intrusion was at the vendor, not inside Sega. The addresses sat on Arara Message, a mail delivery service run by Arara Inc. of Tokyo, which Sega uses for newsletters about its own and Sega Fave's products. Sega says names, dates of birth, sex, addresses, phone numbers, card details and passwords were not in the leaked data, and that addresses held under a SEGA Account sit on a different system and are unaffected.
Sega's release sets out the sequence. On Oct. 29, 2026, it asked Arara whether the newsletter delivery was safe and was told no leak had been confirmed. Sega asked again after Arara disclosed the intrusion, and on Nov. 3, 2026, Arara notified it that addresses used for its mailings had been taken, with a formal report following between Nov. 5 and Nov. 8, 2026. The newsletters involved went out between July and October 2026.
Arara and its parent, Paycloud Holdings, reported on Nov. 6, 2026, that 81,329,467 addresses were taken from Arara Message. That is the vendor's count for its whole platform, covering every client of the service and not Sega's mailings. Arara says the figure counts addresses and not people, that as many as 380 client companies may be affected, on an estimate it is still checking, and that its first report understated the scope. Arara Message has been off since Oct. 31, 2026, with no restart date set.
Sega says it has suspended newsletter delivery through Arara's system until those checks finish, will contact affected customers individually, and plans to file a joint report with Arara to Japan's Personal Information Protection Commission. Both companies say no misuse of the leaked information has been confirmed, and Sega asked recipients to be careful with email claiming to come from either company or from Arara. Sega says the arcade network outage at Sega Fave is a separate matter.
