SEGA Says 2.2 Million Subscriber Emails Exposed in ARARA Newsletter Breach

SEGA confirmed the breach reached 2.2 million email addresses tied to its newsletters, along with 92,300 records carrying additional information the company hasn't pinned down yet. The fallout covers 11 newsletters linked to SEGA and SEGA Fave products and services. So far, nothing juicier than emails appears to be in play.

According to SEGA, the stolen data did not include names, birth dates, gender, addresses, phone numbers, credit card details or account passwords. Emails registered through a SEGA Account run on a separate distribution system and were untouched. SEGA says it is working with ARARA and has no confirmed evidence of misuse.

ARARA's version of events kept shifting. The provider pegged the impact small and told SEGA on October 29 that no data had been compromised, then flipped on November 3 and confirmed exposure once it grasped the full scale, sharing details between November 5 and 8. ARARA's November 2 disclosure put the total at 77 million email addresses from nearly 380 corporate clients, blaming a web server vulnerability and problems in its system environment, with the exact intrusion method and timing still unknown.

The attackers didn't stop at data theft, according to ARARA: they abused access to its service to fire off more than 7 million emails impersonating credit card companies in late October. Other victims of the same incident include MOS Burger with 7.5 million email addresses exposed, Shochiku Multiplex Theatres with 3.3 million records, TKC with 2.3 million email addresses and IIJmio with nearly 1 million.

SEGA Fave is nursing a separate headache. Its ALL.Net and Aime arcade gaming network services went down after unauthorized server access was disclosed on November 2, taking online gameplay, SEGA Lucky Kuji Online and new SEGA ID registrations with it. Those services remain offline for maintenance and safety checks. An initial probe found no evidence of customer or business partner data exfiltration, and payment information was stored separately, so it stayed safe. SEGA says the two incidents are unrelated.