Sega data breach
Was I affected?
Sega confirmed a breach involving up to 2.2 million records (duplicates possible), exposing email addresses. You may be affected if you received Sega or Sega Fave newsletters sent between July and October 2026 about arcade titles (CHUNITHM, Ongeki, maimai), Sega Lucky Kuji or Tokyo Game Show 2026. SEGA Account email addresses are not included. Sega plans to contact affected people individually.
| Announced | Nov 9, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara; Arara told Sega on November 3, 2026 that addresses Sega used for newsletters had leaked |
| Country | Japan |
| Records exposed (may include duplicates) | 2.2 million |
| Data exposed | Email addresses and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Japanese game maker Sega said on November 9, 2026 that email addresses on its newsletter lists leaked after an outsider broke into Arara, the company whose "Arara Message" service sends some of Sega's and group company Sega Fave's newsletters. Sega puts the leak at 2,196,044 email addresses, of which 92,273 also came with information attached to the mailings, which it is still examining with Arara. The newsletters involved went out between July and October 2026 and covered arcade games such as CHUNITHM, Ongeki and maimai, Sega Lucky Kuji prize lotteries and Tokyo Game Show 2026. Names, birth dates, gender, addresses, phone numbers, card data and login passwords were not part of the leak, and addresses registered to SEGA Account use a different mailing system. Sega says no misuse had been seen and it has paused newsletters sent through Arara.
What should I do?
- Be wary of emails that claim to come from Sega, Sega Fave, Arara or one of their games, and don't open links or attachments you weren't expecting.
- Sega says it will never ask for passwords or card details by email; delete any message that does without replying.
- Check game news and lottery offers on Sega's official sites or apps rather than through links in emails.
- Consider filtering or changing the email address you used for these newsletters if spam or scam emails increase.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Dior Korea ₩12.2 billion (about US$8M) in February 2026 over a breach of 1.95 million people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 業務委託企業への不正アクセスによる個人情報流出に関するお詫びとお知らせ (Notice on a personal data leak caused by unauthorized access at a contractor) · Sega (in Japanese) · official
- セガ、委託先システムに不正アクセスでメアド流出。2,196,044件 · GAME Watch (Impress) (in Japanese) · news