SEGA says a breach at its email provider, ARARA, exposed 2,196,044 addresses used for 11 SEGA and SEGA Fave mailings. The company’s November 9 disclosure covers messages sent from July 2 to October 28, including Lucky Kuji lottery announcements and Tokyo Game Show updates. SEGA Account mailing addresses were held in a separate system and were outside the scope of this breach.
How SEGA traced the leak to 11 mailings
On October 29, SEGA asked its mailing provider whether information had leaked and was told that no leak had been confirmed. SEGA says it asked again after ARARA publicly acknowledged unauthorized access. On November 3, ARARA told SEGA that addresses from its mailings had been taken. The companies checked the records from November 5 to 8, and ARARA delivered a formal report.
The investigation pointed to ARARA Message, the service used to deliver the newsletters. Of the exposed addresses, 92,273 records also contained information associated with mail delivery. SEGA did not specify what those extra fields were. It said the exposed data did not include names, dates of birth, gender, postal addresses, phone numbers, credit card details or login passwords. The figure counts email addresses; the company did not provide a count of distinct people.
Which SEGA emails were affected?
Search your inbox for the mailing names and dates in SEGA’s notice. The disclosure lists individual sends. It does not say that all messages from these services were affected.
| Mailing | Affected sends |
|---|---|
| SEGA Lucky Kuji and Lucky Kuji Online | July 6 and 13; September 4 and 7; October 21 and 28 |
| Tokyo Game Show 2026 | September 17 and 18 |
| CHUNITHM Mate, Ongeki Re:Fresh Act.2 and maimai DX MAGiCAL | July 2, July 23 and September 17, respectively |
The same email address can appear on a newsletter list and in an account profile. If you used it for an affected mailing, the newsletter copy could have leaked even though the separate SEGA Account system was outside scope. SEGA also says Lucky Kuji Online was under maintenance because of a separate intrusion involving SEGA Fave’s arcade network. That outage does not establish that the newsletter breach reached player accounts.
Check the next prize or breach notice before acting
SEGA had confirmed no misuse of its exposed information as of November 9. Still, an unexpected “claim your prize” or “confirm your details after the breach” email could borrow the name of a promotion you recognize. Open the service or SEGA support through a bookmark or by navigating there yourself. SEGA and SEGA Fave say they do not ask for passwords or card details by email. See how to check the sender and links in a suspicious message.
If your address is on an affected list, the disclosure alone does not indicate password exposure. If you entered a password through a suspicious message, change it on the real service and anywhere you reused it. If you submitted card details, contact the card issuer using the number on the card or its official app. SEGA says it plans to notify affected customers individually once it confirms the details.
References
- SEGA Corporation. Notice of personal information exposure after unauthorized access at a contractor. November 9, 2026.
- ARARA. ARARA Message service interruption and data exposure notices. Accessed November 10, 2026.
