[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-sega-confirms-22-million-emails-exposed-in-vendor-breach":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12740,"sega-confirms-22-million-emails-exposed-in-vendor-breach","Sega Confirms 2.2 Million Emails Exposed in Vendor Breach","A breach at email vendor Arara exposed 2,196,044 Sega addresses, one slice of a leak that reached up to 380 corporate customers.","Sega says 2,196,044 customer email addresses leaked after attackers broke into Arara, a Japanese marketing vendor that sends its newsletters.\n\nAs of November 9, Sega also counts 92,273 other items \"related to distribution\" among the compromised data. It said names, dates of birth, gender, addresses, phone numbers, credit card information and login passwords have not been leaked \"at this time\", and that no misuse of the leaked information has been confirmed. Addresses tied to a SEGA Account sit on a different distribution system and are excluded. Sega said it is still investigating.\n\nSega's exposure is small next to the whole incident. Arara runs Arara Message, an email platform that holds contact data for its clients. According to Arara, attackers used a web server vulnerability and \"other system weaknesses\" to reach 97 servers holding data for up to 380 corporate customers. They accessed more than 81 million email addresses, plus names, birth dates, phone numbers, postal addresses and membership numbers, with the mix varying by person. A later Arara report added a separate environment with 3.38 million more addresses and over 400,000 records containing personal information.\n\nOther clients dwarf Sega's count. Asoview reported about 15.82 million records and Bic Camera 15.2 million. MOS Burger put its figure at 7.5 million, and Shochiku Multiplex Theaters at 3.3 million.\n\nThe phishing warning is not hypothetical. Arara said the attackers sent more than seven million phishing emails spoofing credit card companies, and it shut the service down on October 31. Sega and Arara both told users not to click links or open attachments in messages claiming to come from them.\n\nThe timing is awkward for Sega. On November 2, its Sega Fave unit said an unidentified attacker had accessed servers behind the ALL.Net and Aime arcade network services, and Sega Fave stressed that the two incidents were unrelated. Those services were taken offline and are reportedly still unavailable. No group has claimed responsibility for either breach.\n\nThe pattern here is concentration. Sega's own systems were not the entry point in the newsletter case, yet its customers carry the risk. When one vendor holds mailing lists for hundreds of companies, a single weak server can expose all of them at once.","[\"data-breach\",\"sega\",\"phishing\",\"supply-chain\"]","2026-11-10T15:25:00.000Z","2026-11-10T16:53:55.503Z","2026-11-10T16:53:55.679Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove or support the unsourced claims: 'the brands often learn about it from the vendor' appears nowhere in the source, and 'Both companies called the two incidents unrelated' goes beyond the source, which attributes the unrelated claim to Sega Fave. Also restore Sega's 'at this time' caveat on the data it says was not leaked, instead of stating flatly that it 'was not part of the leak'.","resolved","security",[32,33,34,35],"data-breach","sega","phishing","supply-chain",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fsega-newsletter-data-breach-sees-2-2-million-email-addresses-exposed-gaming-giant-says-it-is-investigating-but-user-financial-data-not-affected",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]