Sega said on Sunday that 2,196,044 customer email addresses were exposed when a contractor operating its arcade-game newsletters suffered a third-party intrusion, one of Japan's largest disclosed marketing-database leaks this year and a separate incident from ongoing security work on Sega Fave's arcade network servers.
The Tokyo game publisher said Arara Co.'s "Arara Message" platform, used for selected Sega and Sega Fave mailings, was accessed illegally. Of the exposed rows, 92,273 included supplementary delivery information whose exact fields Sega said it was still verifying with the vendor. Names, home addresses, phone numbers, credit-card data and login passwords were not part of the leaked set, according to the company notice posted on 9 November.
Which mailings were affected
Sega listed eleven campaigns between July and October 2026, covering titles such as CHUNITHM Mate, maimai でらっくす, オンゲキ Re:Fresh Act.2, Sega Lucky Lottery sales and Tokyo Game Show 2026 booth announcements. Addresses tied to the separate SEGA Account identity system use a different infrastructure and were not in scope, Sega emphasized, though customers who subscribed to both could still see a newsletter address compromised even if their account login email was not.
Arara publicly acknowledged unauthorized access in late October, isolated affected servers and halted the messaging service on 31 October. Sega said it asked Arara about newsletter safety on 29 October and was initially told no leakage had been confirmed; after Arara's broader disclosure on 1 November, Sega re-checked and received notice on 3 November that mailing-list addresses had exited the environment. Formal tallies arrived between 5 and 8 November ahead of Sunday's customer advisory.
Publisher response and user warnings
Sega said it had seen no confirmed misuse of the leaked data as of 9 November but warned that phishing messages impersonating Sega, Sega Fave or Arara could follow. The company asked users not to open unexpected links or attachments and reminded players that official messages never request passwords or card numbers by email. Newsletter sends through Arara remain paused until safety reviews finish, and affected subscribers will be contacted individually once address-level impact is finalized.
Sega Fave's "Sega Lucky Lottery Online" storefront remains under maintenance tied to a different unauthorized-access review on arcade network hardware, which Sega stressed is not the same case as the Arara marketing database. Corporate statements said Sega would tighten oversight of vendors handling personal data and participate in a joint report to Japan's Personal Information Protection Commission through Arara.
Why the scale matters for arcade fans
Arcade rhythm-game communities in Japan and overseas often rely on location-test and prize-mail lists for limited goods; the address count exceeds two million even though recipients may overlap across multiple lists. Security researchers said the lag between Arara's first public notice and Sega's specificity about list sizes illustrates how downstream clients can inherit breach uncertainty from SaaS vendors.
Sega shares were not materially moved in early Tokyo trade Monday, but the disclosure landed alongside global attention on semiconductor supply-chain security after unrelated U.S. executive controversies. For domestic players, the practical risk is targeted spam or social-engineering pitches referencing arcade titles named in the exposed mailings.