SEGA reported a leak of more than 2.19 million email addresses following unauthorized access to the newsletter system of Arara, a third-party service provider partnered with the Japanese company.
Attackers gained access to Arara’s system, through which the company distributed informational and promotional emails about its products and services. In total, the incident affected 2,196,044 email addresses, of which 92,273 were used to subscribe to various SEGA newsletters.
Among the affected mailings were launch announcements for CHUNITHM Mate, ONGEKI Re:Fresh Act.2, and Maimai DX MAGiCAL, six newsletters about new releases of SEGA Lucky Kuji Online, as well as two messages dedicated to the company’s participation in Tokyo Game Show 2026.
SEGA is conducting an investigation into the incident alongside Arara to determine the full scope of the breach and the circumstances of the unauthorized access. The company does not yet have information regarding cases of misuse of the compromised data.
SEGA urged users to exercise caution when receiving emails. The addresses obtained by the attackers could be used for phishing attacks and sending messages impersonating SEGA or Arara.