Sega reports two million email addresses leaked in breach at newsletter provider Arara
A cyberattack on Arara, a Japanese email delivery provider that distributes newsletters for Sega's publishing arms, exposed more than two million email addresses. Sega says its own user accounts remain unaffected.
Sega has reported that more than two million email addresses were leaked in a cyberattack on Arara, a Japanese email delivery provider that sends newsletters on behalf of the company's publishing divisions. Sega stresses that its own user accounts were not affected by the incident, which it attributes to a breach at a third party rather than in its own systems.
Arara distributes newsletters for several of Sega's publishing arms, and the affected mailing lists reportedly include subscribers to the Like A Dragon and Sonic franchises. Subscribers to these newsletters are therefore among those whose email addresses may have been exposed. The distinction matters for players: the accounts that Sega operates, which still handle in-game rewards and calendar features, appear to be unaffected, so the incident is confined to the contact lists held by the email provider rather than the login and account infrastructure that players use to access games and services.
Sega and Arara are still investigating how the breach occurred, and the investigation has not yet established the method used to reach the provider's systems. The exact scope of the compromised data beyond email addresses has not been made clear, so it remains unknown whether any other information was taken alongside the addresses. It has also not been reported whether the leaked addresses have been misused so far, which leaves subscribers without a clear picture of the immediate risk to them.
Both companies are urging newsletter subscribers to be alert to phishing attempts, particularly messages that appear to come from Sega or its publishing brands and ask for personal information, passwords or payment details. Because the attackers now hold a large list of genuine addresses tied to specific game franchises, fraudulent messages built around those titles could appear convincing. Players who receive unexpected emails are advised to treat them with caution, avoid clicking unfamiliar links, and verify any request directly through official Sega channels until the investigation is complete.
The incident underlines a wider risk for games publishers that rely on outside firms to run marketing communications. A single compromised delivery service can expose the contact details of many separate brands at once, even when the publishers' own platforms remain secure. Sega's statement makes clear that its accounts were not the point of entry, but it also shows how much subscriber data can sit with suppliers outside the publisher's direct control.
Source: rockpapershotgun.com
16
