More than 2.1 million email addresses used for SEGA newsletters have leaked after an attacker breached an outside company’s mailing system.
SEGA disclosed on November 9 that contractor Arara suffered unauthorized access to the service used for newsletters covering SEGA and SEGA Fave products. The incident exposed 2,196,044 email addresses. Another 92,273 records included additional information associated with newsletter delivery, which remains under investigation.
The breach was highlighted by Denfaminicogamer.
SEGA Account Passwords Were Not Exposed
SEGA says names, birth dates, gender, home addresses, phone numbers, credit-card details, and login passwords were not included in the leak. Email addresses registered to SEGA Account use a separate delivery system and are outside the affected group.
That narrows the damage, but it does not make the exposed addresses harmless. Someone sending a fake prize notice, account warning, preorder offer, or survey now has a list of people already known to follow SEGA’s games and services.
SEGA says it has not found evidence that the leaked information has been misused. It is warning subscribers not to open unexpected links or attachments and says neither SEGA nor SEGA Fave will ask for passwords or payment information by email. Messages claiming to come from Arara should receive the same scrutiny.
The Contractor Initially Reported No Leak
The timeline makes the disclosure more uncomfortable. On October 29, Arara reportedly told SEGA that it had not found an information leak. After Arara publicly announced unauthorized access on November 1, SEGA asked again. The contractor notified SEGA on November 3 that addresses used for its mailings had been exposed, with a formal report arriving after further checks between November 5 and November 8.
SEGA has suspended newsletters sent through the affected system. It plans to contact affected customers individually after the remaining details are confirmed and says it will publish further information if the investigation uncovers anything material.
Subscribers do not need to reset a SEGA Account password because of this disclosure alone. They should be much less trusting of any urgent SEGA-themed email that arrives next.
