Sega announced that “Arara Message,” the email distribution service provided by Arara—to which Sega had outsourced its email newsletter distribution—was subject to unauthorized access by a third party, resulting in the leak of 2,196,044 email addresses.
Over 2.19 million email addresses were leaked, and “information related to the distribution” was also included for over 90,000 of them.
The leak was discovered among the recipients of certain email newsletters that Sega and its group company, Sega Fave, had been distributing via “Arara Message.”
The total number of affected email addresses is 2,196,044, and 92,273 of those reportedly also contained “information associated with the distribution.” It has not been disclosed exactly what this “information associated with the distribution” refers to, and an investigation is currently underway in collaboration with Arara.
On the other hand, it has been confirmed that names, dates of birth, genders, addresses, phone numbers, credit card information, and login passwords were not compromised. Additionally, email addresses registered with “SEGA Account” are not affected by this incident, as they use a separate distribution system.
The affected email newsletters consisted of a total of 11 issues sent between July and October 2026. It appears that the email addresses of some subscribers to these newsletters were leaked; the details are as follows:
July 2: Announcement of the Launch of *CHUNITHM Mate*
July 6: Sega Lucky Lottery Online Release Information
July 13: Sega Lucky Lottery Online Release Information
July 23: Announcement of the Launch of “Ongeki Re:Fresh Act.2”
September 4: Sega Lucky Lottery Release Information
September 7: Sega Lucky Lottery Online Release Information
September 17: Tokyo Game Show 2026 Exhibition Information
September 17: Announcement of the Launch of “maimai de-lux MAGiCAL”
September 18: Tokyo Game Show 2026 Exhibition Information
October 21: Sega Lucky Lottery Online Release Information
October 28: Sega Lucky Lottery Online Release Information
Initial reports stated that “no data leak had been confirmed”
According to the announcement, as of October 29, Sega had received a report from Arara stating that “no data breach had been confirmed.” However, after Arara publicly disclosed the unauthorized access on November 1, Sega re-examined the situation and reportedly received notification on November 3 that a data breach had been confirmed.Subsequently, both companies conducted additional verification from November 5 to 8 and reportedly received a formal report from Arara.
At this time, no misuse of the leaked information has been confirmed. Sega will file a joint report with Arara to the Personal Information Protection Commission and will contact affected individuals individually as soon as the details of the leaked information are confirmed. Until security is confirmed, the distribution of the “Arara Message” email newsletter will also be suspended.
They are also urging users not to open URLs or attachments in emails they do not recognize, nor to reply to such messages. Sega and Sega Fave will never ask for passwords or credit card information via email, and users should be wary of suspicious emails claiming to be from Arara.
Sega Fave Also Reports Unauthorized Access to “ALL.Net” and “Aime”
Regarding Sega Fave, third-party unauthorized access was also detected on the servers for the arcade game network services “ALL.Net” and “Aime,” leading to the suspension of both services starting at 3:00 PM on November 1. Although this is a separate incident from the current one, as a result, “Sega Lucky Lottery Online” is also undergoing maintenance to verify security, and users are currently unable to log in or make purchases.
Some functions of ALL.Net were restored as of 9:00 AM on November 8, and Bandai Namco titles resumed trial operations on the same day. However, maintenance for ALL.Net and Aime continues for Sega titles, and online services remain unavailable.There is currently no estimated timeline for restoration, and the next update is scheduled for around 9:00 a.m. on November 10.
