EN PT-BR
← Voltar ao feed
high gaming entertainment food_service telecommunications

SEGA confirms 2.2 million newsletter email addresses exposed in breach at vendor ARARA

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 19:09 · coletado há 1 hora

SEGA disclosed that a breach at its third-party newsletter provider ARARA exposed the email addresses of 2.2 million newsletter subscribers, with 92,300 further records carrying additional data still under review (bleepingcomputer.com). SEGA's own announcement counts 2,196,044 addresses and 92,273 records with newsletter-delivery information (cyberinsider.com). The exposed data does not include names, dates of birth, gender, postal addresses, phone numbers, card details or passwords, and addresses registered with a SEGA Account run on a separate distribution system and were not affected. SEGA says it has no confirmed evidence of misuse. The main risk for defenders is phishing and impersonation of SEGA, SEGA Fave and ARARA, since the leaked data is limited to email addresses and related delivery information. SEGA FAVE's separate arcade network outage is, according to SEGA, unrelated to this incident.

Detalhes técnicos

  • ARARA said a web server vulnerability and problems in its system environment contributed to the incident, and the exact intrusion method and timing are still under investigation (bleepingcomputer.com). Infosecurity Magazine reports that unauthorized access to ARARA's servers happened on October 28 after a hacker exploited web server vulnerabilities (infosecurity-magazine.com). No CVE identifier has been named for that flaw in the sources reviewed.
  • The incident hit ARARA's email distribution service, reportedly compromising 77 million addresses from nearly 380 corporate clients. Other victims named in the article are MOS Burger (7.5 million addresses), Shochiku Multiplex Theatres (3.3 million records), TKC (2.3 million addresses) and IIJmio (nearly 1 million addresses).
  • ARARA said attackers abused their access to the service to send over 7 million emails impersonating credit card companies in late October (bleepingcomputer.com).
  • The exposed SEGA addresses came from 11 newsletters sent in July, September and October (animenewsnetwork.com).

Remediação

  • No fix has been published for the flaw in ARARA's web servers. ARARA has not named the intrusion method or the corrective measures in the article, and the sources reviewed do not describe them.
  • SEGA has suspended newsletters sent through ARARA until it verifies the exposed information and completes safety checks (cyberinsider.com).
  • Defenders should treat messages claiming to come from SEGA, SEGA Fave, ARARA or credit card companies as suspicious and verify them through official channels. Since passwords were not exposed, the main action is anti-phishing awareness and filtering of impersonation attempts.

Relatos divergentes

  • The article gives 92,300 records with additional information; SEGA's figure, as reported by cyberinsider.com and animenewsnetwork.com, is 92,273. The SEGA announcement is the more precise source.
  • The article says ARARA disclosed the breach on November 2. Cyberinsider.com reports that ARARA publicly disclosed unauthorized access on November 1. Infosecurity Magazine says ARARA issued its statement on October 29, with the access dated October 28. These dates differ and have not been reconciled by a primary source.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 09/11/2026 19:09 · coletado 09/11 21:00 primeiro registro

    SEGA confirms 2.2 million newsletter email addresses exposed in breach at vendor ARARA

    ler a análise desta fonte

    SEGA disclosed that a breach at its third-party newsletter provider ARARA exposed the email addresses of 2.2 million newsletter subscribers, with 92,300 further records carrying additional data still under review (bleepingcomputer.com). SEGA's own announcement counts 2,196,044 addresses and 92,273 records with newsletter-delivery information (cyberinsider.com). The exposed data does not include names, dates of birth, gender, postal addresses, phone numbers, card details or passwords, and addresses registered with a SEGA Account run on a separate distribution system and were not affected. SEGA says it has no confirmed evidence of misuse. The main risk for defenders is phishing and impersonation of SEGA, SEGA Fave and ARARA, since the leaked data is limited to email addresses and related delivery information. SEGA FAVE's separate arcade network outage is, according to SEGA, unrelated to this incident.

    Technical Details

    • ARARA said a web server vulnerability and problems in its system environment contributed to the incident, and the exact intrusion method and timing are still under investigation (bleepingcomputer.com). Infosecurity Magazine reports that unauthorized access to ARARA's servers happened on October 28 after a hacker exploited web server vulnerabilities (infosecurity-magazine.com). No CVE identifier has been named for that flaw in the sources reviewed.
    • The incident hit ARARA's email distribution service, reportedly compromising 77 million addresses from nearly 380 corporate clients. Other victims named in the article are MOS Burger (7.5 million addresses), Shochiku Multiplex Theatres (3.3 million records), TKC (2.3 million addresses) and IIJmio (nearly 1 million addresses).
    • ARARA said attackers abused their access to the service to send over 7 million emails impersonating credit card companies in late October (bleepingcomputer.com).
    • The exposed SEGA addresses came from 11 newsletters sent in July, September and October (animenewsnetwork.com).

    Remediation

    • No fix has been published for the flaw in ARARA's web servers. ARARA has not named the intrusion method or the corrective measures in the article, and the sources reviewed do not describe them.
    • SEGA has suspended newsletters sent through ARARA until it verifies the exposed information and completes safety checks (cyberinsider.com).
    • Defenders should treat messages claiming to come from SEGA, SEGA Fave, ARARA or credit card companies as suspicious and verify them through official channels. Since passwords were not exposed, the main action is anti-phishing awareness and filtering of impersonation attempts.

    Conflicting Reports

    • The article gives 92,300 records with additional information; SEGA's figure, as reported by cyberinsider.com and animenewsnetwork.com, is 92,273. The SEGA announcement is the more precise source.
    • The article says ARARA disclosed the breach on November 2. Cyberinsider.com reports that ARARA publicly disclosed unauthorized access on November 1. Infosecurity Magazine says ARARA issued its statement on October 29, with the access dated October 28. These dates differ and have not been reconciled by a primary source.