Japanese gaming giant Sega has confirmed a data breach affecting more than two million customers worldwide.
According to the firm, email addresses of 2.2 million newsletter subscribers were exposed through a breach of its third-party newsletter provider, Arara. The breach affected customers receiving any of 11 different newsletters, and also saw 92,300 other records exposed.
In a statement confirming the incident, Sega said leaked data does not include customer names, dates of birth, gender, addresses, phone numbers, login passwords, or credit card information.
“We take this situation seriously and will work to further strengthen and thoroughly implement our information management system, including personal information related to outsourced work,” the company said.
How did the Sega data breach unfold?
Arara first disclosed the breach of its email distribution service on 2 November, saying that 77 million email addresses from nearly 380 corporate clients had been compromised.
Other data included dates of birth, phone numbers, postal addresses, and membership numbers.
"In collaboration with external specialized organizations, we are investigating the intrusion route, the timing of the initial breach, and the scope of the impact," Arara said.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
"Furthermore, we are implementing measures to prevent a recurrence, including a comprehensive update of authentication credentials, system reconstruction, and the strengthening of our monitoring framework."
According to Arara, the breach occurred due to a web server vulnerability and 'problems' in its system environment. Other victims included Asoview, with 15.82 million records exposed, while electronics retailer Bic Camera reported 15.2 million.
Other organizations impacted in the breach include:
- MOS Burger (7.5 million email addresses)
- Shochiku Multiplex Theatres (3.3 million)
- TKC (2.3 million)
As a result of the breach, Arara said the attackers were able to send more than seven million emails impersonating credit card companies in late October.
Sega hit by second breach
On the same day as the Arara announcement, Sega revealed it had been affected by a separate breach at its Fave subsidiary.
Fave handles distribution of toys, electronic gadgets, and arcade machine operations.
The company said it suspended operations in response to the incident, but added there is no evidence that any customer or partner data had been stolen.
Sega issues phishing warning
Sega has also urged customers to be wary of potential phishing attacks in the wake of the incident. The company warned users not to click unsolicited links, attachments, replies, or requests for sensitive information.
Phishing scams are a common tactic employed by threat actors in the wake of data breaches. With customer information exposed, hackers seek to capitalize on the situation – and customer confusion – to conduct follow-up attacks.
"The attackers know the data relates to Sega, so the most common tactic would be to send phishing emails which are disguised as correspondence around the breach but trick recipients into revealing further confidential information," Donnan commented.
"Customers of Sega must be on the lookout for these scams and be careful of all emails they receive which encourage them to click on links or reveal personal or financial data."