Sega disclosed on November 9, 2026, that more than 2 million email addresses had leaked after unauthorized access to Arara, the company's email provider. The incident also exposed information associated with certain newsletters about Sega products and services.
The affected Sega announcements
Sega identified 92,273 affected addresses associated with newsletter distribution. The affected releases included:
- The launch announcement for arcade rhythm game CHUNITHM Mate.
- Six release newsletters for Sega Lucky Kuji Online, an online character lottery service.
- The launch announcement for rhythm game update ONGEKI Re:Fresh Act.2.
- Two exhibition announcements for Tokyo Game Show 2026.
- The launch announcement for rhythm game update Maimai DX MAGiCAL.
Sega Lucky Kuji Online was still undergoing maintenance when Sega announced the leak, following the previous week's Sega Fave server breach.
Sega Accounts and personal data
Sega Accounts were unaffected because the service uses a separate email distribution system.
Sega Accounts were not affected
Sega said customer names, dates of birth, genders, residential addresses, telephone numbers, credit card information, and login passwords associated with the affected emails had not been leaked.
No cases of misuse of the exposed information had been reported as of Sega's November 9 announcement.
Sega said it would strengthen its information management systems, including how personal information entrusted to external service providers is handled. Arara has also proposed a joint report to Japan's Personal Information Protection Commission.
Sega plans to contact each affected person individually once the details of the leaked information have been confirmed.
