SEGA said on 9 November 2026 that ARARA, whose distribution system it uses for some newsletters for SEGA and SEGA Fave products and services, suffered unauthorised access by a third party, and that customer email addresses used for newsletter delivery and associated delivery information were leaked. As of 9 November, SEGA puts the affected records at 2,196,044 email addresses, of which 92,273 include associated delivery information, still being investigated with ARARA; the affected newsletters were sent between 2 July and 28 October 2026.

SEGA says names, dates of birth, gender, addresses, phone numbers, credit card information and login passwords were not leaked, that email addresses registered with a SEGA Account use a separate system and are not affected, and that no misuse has been confirmed.

Timeline per SEGA: on 29 October ARARA told SEGA no leak had been found; after ARARA's 1 November announcement SEGA checked again; on 3 November ARARA notified SEGA that the addresses had leaked, and gave a formal report between 5 and 8 November.

SEGA plans a joint report with ARARA to Japan's Personal Information Protection Commission, will contact affected customers individually, has paused newsletters sent through ARARA's system, and warns of phishing that impersonates SEGA, SEGA Fave or ARARA.

SEGA says the separate SEGA Fave arcade network incident is a different matter. (source: SEGA) According to BleepingComputer, ARARA said the wider incident exposed 77 million email addresses from nearly 380 corporate clients. (source: BleepingComputer)