# SZB-ee55e3721d: SEGA discloses breach at newsletter provider ARARA exposing 2.2 million emails SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. - Type: Breach - Status: Confirmed - Vendor: SEGA - Product: Arara Message - Disclosed: 2026-11-09 07:52 UTC - Data taken: 2.2M records: Email addresses - Through: ARARA (BleepingComputer: “Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newslette…”, [source](https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/)) - Sources: 9 distinct - First seen by cve.now: 2026-11-09 07:54 UTC · Updated: 2026-11-10 03:55 UTC Written by a model from the sources below. Verify against them. ## Summary The report relies on SEGA's disclosure and does not describe other data types or the attackers. ## What to do - Expect phishing that uses this breach; verify messages that mention it · For email addresses - Do not click unexpected links or attachments claiming to be from SEGA - Check SEGA's official notice for guidance on affected subscribers ## Timeline - 2026-11-09 07:52 UTC: Made public by BleepingComputer - 2026-11-09 07:54 UTC: First seen by cve.now - 2026-11-09 22:09 UTC: Confirmed by SEGA. BleepingComputer: “Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newslette…” ([source](https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/)) - 2026-11-10 03:55 UTC: Record last updated ## What was taken 2.2M records, per [Bluesky](https://bsky.app/profile/hackmanac.com/post/3mzugyvlsrc2s). - Email addresses: [Bluesky](https://bsky.app/profile/hackmanac.com/post/3mzugyvlsrc2s): “SEGA Corporation disclosed a data breach affecting 2,196,044 customer email addresses following unauthorised access to Arara Message, a third-party email distribution platform.” ## Evidence (9 sources) - 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/hackmanac.com/post/3mzugyvlsrc2s): “SEGA Corporation disclosed a data breach affecting 2,196,044 customer email addresses following unauthorised access to Arara Message, a third-party email distribution platform.” (+4 more: [Bluesky](https://bsky.app/profile/thecybersecguru.com/post/3mzv6tjrqz32i), [Bluesky](https://bsky.app/profile/finalweapon.net/post/3mzviv7tfx42l), [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/bp7nzhbt5nicp), [Bluesky](https://bsky.app/profile/privacyunpacked.bsky.social/post/3mzw7wnqsr72u)) - 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzv3ix2y7i2j): “Gaming giant Sega has disclosed that approximately 2.2 million customer email addresses were exposed following a…” - 2026-11-09 · Social · [Mastodon](https://mastodon.social/@cyzoio/117586919944726833): “https://www. infosecurity-magazine.com/news /email-sega-customers-vendor-breach/” (+2 more: [Mastodon](https://infosec.exchange/@AAKL/117587662004922582), [Mastodon](https://mastodon.social/@RedPacketSecurity/117589920654797063)) - 2026-11-09 · Social · [Mastodon](https://thecybersecguru.com/news/sega-arara-data-breach-php2shell-analysis/): “Sega confirmed 2,196,044 leaked email addresses after the Arara Message breach.” - 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/crustytldr.bsky.social/post/3mzvmhmtqce2p): “SEGA Data Breach: 2.19M Customer Emails Leaked in Arara Vendor Attack - homeland411.com” (+1 more: [Bluesky](https://bsky.app/profile/thenerdsenpaii.bsky.social/post/3mzvtxpas222s)) - 2026-11-09 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/): “Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzvwwap6pi2w)) - 2026-11-09 · Social · [Mastodon](https://mastodon.social/@Analyst207/117588822915703185): “A security breach at SEGA's third-party newsletter provider exposed a whopping 2.2 million email addresses of newsletter subscribers, putting them at risk of spam and phishing attacks.” - 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzvy5qa5642f): “SEGA has confirmed that a data breach involving its third-party newsletter distribution provider, ARARA, exposed the email…” - 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/ebansu.bsky.social/post/3mzwjzpdt5f23): “ゲーム大手のセガは、第三者のニュースレター配信プロバイダ「ARARA」で発生したデータ侵害により、ニュースレター登録者のメールアドレス220万件が露見したことを明らかにしました。” ## Corrections - 2026-11-09: Changed “Email addresses were exposed” to “Email addresses of newsletter subscribers were exposed”. - 2026-11-09: Changed “Email addresses of newsletter subscribers were exposed” to “Email addresses were exposed”. Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-ee55e3721d&body=https%3A%2F%2Fcve.now%2FSZB-ee55e3721d%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A ## Questions about the ARARA breach affecting SEGA ### Was SEGA customer data exposed? Yes. The breach was at ARARA, a vendor of SEGA. SEGA says so: “Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers.” (BleepingComputer). Source: https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/ ### What data was exposed? 2.2M records. Email addresses. ### What should SEGA customers do? Expect phishing that uses this breach; verify messages that mention it. Do not click unexpected links or attachments claiming to be from SEGA. Check SEGA's official notice for guidance on affected subscribers. ## Related - Started as early warning SZB-ee55e3721d, first seen 2026-11-09 07:54 UTC - Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/SZB-ee55e3721d Site guide for agents: https://cve.now/llms.txt