Sega Was Told on October 29 That Nothing Had Leaked. Its Email Vendor Lost 2.2 Million Customer Addresses

Sega asked its email vendor a simple question on October 29: had any of our customer data leaked? The answer was no. Five days later the same vendor wrote back to say it had. On Monday, Sega said 2,196,044 email addresses from its newsletters are now in the hands of an unknown third party.

The vendor is Arara, a Japanese company whose Arara Message service sends marketing email for hundreds of businesses. Sega and its arcade subsidiary Sega Fave used it for newsletters about game launches and prize draws.

Eleven newsletters, four months

The leaked addresses come from 11 mailings sent between July 2 and October 28, 2026. They include launch notices for the arcade games CHUNITHM Mate, Ongeki Re:Fresh Act.2 and maimai DX, Sega's Tokyo Game Show 2026 announcements, and six mailings for the Sega Lucky Kuji online prize lottery.

For 92,273 of those addresses, what Sega calls "information associated with delivery" also leaked. The company has not said what that means and is still working it out with Arara. It says names, birth dates, gender, postal addresses, phone numbers, card details and passwords were not exposed, and that addresses registered to a SEGA Account sit on a different system and are not affected.

How the answer changed

Sega's own timeline is the uncomfortable part. Its October 29 check with Arara came back clean. After Arara went public with the intrusion, Sega asked again on November 1. On November 3, Arara emailed to confirm that addresses Sega had used were leaked, and a formal report followed between November 5 and 8.

Arara has said attackers got into its servers on October 28 by exploiting vulnerabilities in its web servers, and the service has been offline since October 31. Its parent company, Paycloud Holdings, has put the exposure at around 380 corporate clients and 77 million email addresses. Sega is far from the biggest name on that list: electronics chain Bic Camera reported about 14.9 million records, alongside airlines and retailers we covered last week.

Sega says it has seen no misuse yet. It has paused all newsletters sent through Arara, will file a joint report with Arara to Japan's Personal Information Protection Commission, and plans to contact affected customers once the details are confirmed. Until then it is warning players about emails that pretend to come from Sega or use the names of its games, the obvious next move for anyone holding a list of fans who signed up for lottery and launch alerts.

The leak is separate from another recent intrusion at Sega Fave, which hit its arcade network services and is the reason the Lucky Kuji online lottery is already down for maintenance.

Some offers on this page may be paid placements or contain affiliate links.