Sega says 2,196,044 customer email addresses leaked after attackers broke into Arara, a Japanese marketing vendor that sends its newsletters.
As of November 9, Sega also counts 92,273 other items "related to distribution" among the compromised data. It said names, dates of birth, gender, addresses, phone numbers, credit card information and login passwords have not been leaked "at this time", and that no misuse of the leaked information has been confirmed. Addresses tied to a SEGA Account sit on a different distribution system and are excluded. Sega said it is still investigating.
Sega's exposure is small next to the whole incident. Arara runs Arara Message, an email platform that holds contact data for its clients. According to Arara, attackers used a web server vulnerability and "other system weaknesses" to reach 97 servers holding data for up to 380 corporate customers. They accessed more than 81 million email addresses, plus names, birth dates, phone numbers, postal addresses and membership numbers, with the mix varying by person. A later Arara report added a separate environment with 3.38 million more addresses and over 400,000 records containing personal information.
Other clients dwarf Sega's count. Asoview reported about 15.82 million records and Bic Camera 15.2 million. MOS Burger put its figure at 7.5 million, and Shochiku Multiplex Theaters at 3.3 million.
The phishing warning is not hypothetical. Arara said the attackers sent more than seven million phishing emails spoofing credit card companies, and it shut the service down on October 31. Sega and Arara both told users not to click links or open attachments in messages claiming to come from them.
The timing is awkward for Sega. On November 2, its Sega Fave unit said an unidentified attacker had accessed servers behind the ALL.Net and Aime arcade network services, and Sega Fave stressed that the two incidents were unrelated. Those services were taken offline and are reportedly still unavailable. No group has claimed responsibility for either breach.
The pattern here is concentration. Sega's own systems were not the entry point in the newsletter case, yet its customers carry the risk. When one vendor holds mailing lists for hundreds of companies, a single weak server can expose all of them at once.