Sega: Newsletter Vendor Arara Breach Exposes 2.19 Million Email Addresses

"Sega says an intruder broke into Arara Message, the email delivery service it used for some newsletters, and took 2,196,044 email addresses. The addresses belong to people who received mailings from Sega and its group…"

Sega says an intruder broke into Arara Message, the email delivery service it used for some newsletters, and took 2,196,044 email addresses. The addresses belong to people who received mailings from Sega and its group company Sega Fave between July and October 2026. Those mailings included launch notices for the arcade titles CHUNITHM Mate, maimai DX MAGiCAL and Ongeki Re:Fresh Act.2. Sega's notice of 9 November says 92,273 of the addresses were stored alongside "information associated with the distribution." The company has not said what that information is. Sega says no names, dates of birth, genders, postal addresses, phone numbers, credit card details or login passwords were taken. It says it has seen no misuse of the data so far. The Sega leak is one part of a much larger breach at Arara. The vendor's parent company, PayCloud Holdings, now puts the total at about 77 million addresses across up to roughly 380 client companies.

What Happened

Sega's own timeline shows how hard it was for a client to find out what had happened at its vendor. On 29 October, Sega asked Arara whether its newsletter mailings were safe. Arara said no leak had been found. Arara disclosed the intrusion publicly on 1 November, and Sega asked again. Game*Spark, reporting Sega's notice, says Arara told Sega on 3 November that a leak had been confirmed. The two companies then checked further between 5 and 8 November, and Arara sent Sega a formal report.

Other Arara clients describe the same pattern. Rescana reports that Solaseed Air was told on 30 October that none of its data had leaked, then told on 2 November that its customers' addresses might have been taken.

The leaked addresses come from recipients of 11 mailings. The first went out on 2 July (the CHUNITHM Mate launch) and the last on 28 October (a Sega Lucky Kuji Online sales notice). The other mailings covered Sega Lucky Kuji sales and Sega's Tokyo Game Show 2026 exhibit. Sega has paused all newsletter sending through Arara Message until the service is confirmed safe. Game*Spark reports that Sega will file a report with Japan's Personal Information Protection Commission jointly with Arara, and will contact affected people individually once it knows more about the leaked data.

There is a second, separate Sega incident. Sega Fave's arcade network services, ALL.Net and Aime, were also accessed without authorisation and went offline at 15:00 on 1 November. Sega says this is a different case. Sega Lucky Kuji Online is still down for maintenance while those systems are checked. Game*Spark reports that some ALL.Net functions came back on 8 November, but Sega titles are still offline and there is no date for restoration.

What Was Taken

According to Sega:

2,196,044 email addresses of people on the affected newsletter lists.
92,273 of those were stored with "information associated with the distribution." Sega and Arara are still investigating what this means.
Not taken: names, dates of birth, gender, postal addresses, phone numbers, credit card data and login passwords.
Not affected: email addresses registered to a SEGA Account. Sega says those go through a different delivery system.

Across Arara's whole customer base, the numbers are larger and still changing. ICHI Global and Rescana both summarise PayCloud's reports. The first report, on 29 October, covered one system and about 3.01 million addresses. The second, on 2 November, raised the total to about 77 million addresses that were taken or may have been taken. PayCloud says this figure has not been de-duplicated, is still being checked, and does not count people, because one person can have several addresses. Depending on the client, Arara's stored records also included names, gender, dates of birth, phone numbers, membership numbers and addresses. Sega says none of these were in its leaked data. Arara says it holds no card numbers.

Other clients' notices give a sense of the spread. Rescana reports that AIRDO lost up to 673,920 addresses and Solaseed Air about 490,000. The Buddhist altar retailer Hasegawa confirmed 305 addresses, leaked through Arara's "repica" server.

Why It Matters

The addresses themselves are not very sensitive. The bigger risk is what an attacker can do with a verified list of people who are known to be interested in particular Sega products. That makes convincing phishing easy: fake ALL.Net restoration notices, fake Lucky Kuji prize or purchase alerts, or fake "account security" emails that play on the separate arcade network outage. Sega warns that fraudsters may pose as Sega, Sega Fave or Arara.

Attackers have already shown this works on Arara's platform. ICHI Global reports that between 28 and 30 October, attackers used two Arara environments to send up to about 7.13 million phishing emails posing as a credit card company, from [email protected]. They sent these to address lists they had brought in from outside. Because the mail came from a real delivery platform with a good sending reputation, it was more likely to get past spam filters.

Arara is not the only case. The Tokyo Nomad reports that five Japanese mass-mail and messaging services were breached between 11 October and 2 November: Arara Message, Cuenote FC, SpeeCAN RAIDEN, Blastmail and COMSBI Enterprise. Three of them were used to send phishing. The outlet says no source links the five breaches to a single attacker.

The Attack Technique

Accounts of how the attacker first got in differ.

Rescana reports that PayCloud's first report blamed a web server vulnerability.
The Tokyo Nomad, writing after the second report, says the initial entry point at Arara is still under investigation.

Accounts agree on what happened after the attacker got in. ICHI Global and Rescana both report, based on PayCloud's second report, that between 28 and 31 October the intruder moved from an Arara Message server into 97 servers holding client mailing lists and copied database contents. Data was taken between 01:36 on 29 October and 02:22 on 30 October, Japan time.

No CVE has been assigned. No group has claimed responsibility, and no one has publicly attributed the attack.

What Organizations Should Do

Find out which messaging vendors you use, including indirect ones. Check whether Arara Message, repica or the other breached Japanese platforms sit behind your marketing tools or CRM integrations. Hasegawa, for example, was exposed through Arara's repica server, which was connected to its main email service.
Don't accept "no leak found" as the final answer. Sega and Solaseed Air were both told nothing had leaked, days before leaks were confirmed. Ask the vendor in writing what data it holds for you and what logs support its conclusion, and check again after each new disclosure.
Change every credential you gave the vendor, including API keys, SMTP credentials and portal passwords. Stop sending through the platform until it has been confirmed clean.
Look for phishing that uses your brand. Monitor for lookalike domains. Check mail gateway logs for messages from the vendor's sending domains (for example arara.com) that you did not send. Check that your SPF and DKIM records do not authorise a compromised sender you no longer use.
Delete data you no longer need. Purge old mailing lists held by vendors and remove retired vendors from your sending records, so a breach at the vendor exposes less.
Tell customers clearly what to expect. Sega's notice is a good model: it says plainly that the company will never ask for passwords or card numbers by email, and warns customers about emails claiming to be from the vendor.

_Sources: Unauthorized Access to Sega's Newsletter Delivery Contractor Leaks... | 業務委託企業への不正アクセスによる個人情報流出に関するお詫びとお知らせ｜株式会社セガ | ICHI Global Five Minute Cyber Rundown · ICHI Daily · ICHI Briefs &... | AIRDO and Solaseed Air Email-Vendor Breach: What to Do Now – Rescana | Japan’s mail-delivery platform breaches: Arara, Cuenote | セガのメルマガ配信委託先に不正アクセス、メールアドレス219万件超が流出―『CHUNITHM』『maimai』稼働告知などの配信先（G... | [メール配信委託先への不正アクセスに伴う個人情報の漏洩に関するお詫びとお知らせ（第二報）

       お...](https://www.hasegawa.jp/blogs/news/261105) | [Sega's Email Newsletter Distribution Service Provider Was Illegally...](https://ground.news/article/segas-email-newsletter-distribution-service-provider-was-illegally-accessed-resulting-in-the-leak-of-over-219-million-email-addressesinclud)_

       お...](https://www.hasegawa.jp/blogs/news/261105) | [Sega's Email Newsletter Distribution Service Provider Was Illegally...](https://ground.news/article/segas-email-newsletter-distribution-service-provider-was-illegally-accessed-resulting-in-the-leak-of-over-219-million-email-addressesinclud)_