Sega has had two bad weeks in one. The company disclosed Monday, according to Infosecurity Magazine, that 2,196,044 customer email addresses leaked after attackers got into Arara Inc., the Japanese firm that sends Sega's newsletters — a completely separate incident from the arcade-network intrusion that knocked Japan's game centers offline eight days earlier.
The leaked data is email addresses, plus 92,273 records carrying additional distribution-related information Sega is still working to identify. The company says no names, dates of birth, addresses, phone numbers, credit card details, or login passwords were exposed, and email addresses tied to SEGA Accounts are unaffected because that service uses a different delivery system. No misuse has been confirmed — but Sega is warning customers to expect phishing emails impersonating Sega or its arcade subsidiary Sega Fave, and to never open links or attachments from senders they don't recognize.
The telling part is the scale behind Sega's number. Arara disclosed on October 29 that attackers had exploited vulnerabilities in its web servers the day before, and shut its Arara Message service down on October 31; it remains offline. Its parent company, Paycloud Holdings, confirmed on November 2 that roughly 380 corporate clients were caught in the same breach, with around 77 million email addresses exposed — a figure Arara later raised to more than 81 million deduplicated addresses. For some of those clients, names, phone numbers, and addresses were exposed too. Sega is just the household name attached to one slice of it.
And the timing could hardly be worse for the company. Sega Fave, the arcade arm, is still picking through its own intrusion: unauthorized access to servers behind ALL.Net, the network that links arcade cabinets across Japan, forced a full shutdown on November 1. Eight Bandai Namco titles began a trial restart on November 8; Sega's own games — maimai, CHUNITHM, Initial D — are still dark, with the next status update due November 10. Sega says it will file a joint report with Japan's Personal Information Protection Commission and has suspended its Arara newsletters until the platform is verified safe.
Two intrusions, two different doors, one week. Neither touched passwords or payment data, and that will keep this out of the worst-breach headlines. But the pattern is the story: the vendor you never think about — the company that sends the marketing emails — held the keys to 81 million inboxes, and one exploited web server was enough. Sega's 2.2 million is the number with a brand on it. The other 79 million belong to companies that haven't said anything yet.
— via Infosecurity Magazine