SEGA confirms 2.2 million newsletter email addresses leaked in supplier breach
SEGA has confirmed that 2.2 million email addresses used for its newsletters were exposed after attackers broke into ARARA, the Japanese company that delivers some SEGA and SEGA Fave mailings. The disclosure, published on 9 November, puts the exact count at 2,196,044 addresses, with 92,273 records also carrying distribution-related information that is still being investigated. The affected mailings cover 11 newsletters sent between 2 July and 28 October, including notices for arcade titles CHUNITHM, maimai and Ongeki, SEGA Lucky Kuji and Tokyo Game Show. SEGA says names, dates of birth, addresses, phone numbers, payment details and passwords were not exposed, and addresses registered through SEGA Account use a separate system and were unaffected. No misuse has been confirmed, but SEGA has warned subscribers to watch for phishing emails impersonating the company. The breach is part of a wider incident at ARARA, which says about 77 million addresses across nearly 380 client companies were exposed.
Sources: BleepingComputer — SEGA newsletter data breach exposes 2.2 million email addresses, 9 Nov · Infosecurity Magazine — Email Addresses of 2.2 Million Sega Customers Leaked in Vendor Breach, 9 Nov