Sega confirms 2.2 million newsletter email addresses leaked via breach at email provider Arara
On November 9, Sega disclosed that an unauthorized third party leaked about 2.2 million customer email addresses after gaining access to Arara Inc., a Japanese email delivery provider that Sega used to distribute its newsletters. The breach covers 2,196,044 addresses for various newsletters and 92,273 distribution-related items. Sega says the leak does not include names, dates of birth, genders, postal addresses, phone numbers, credit card data or passwords, and no misuse has been confirmed. The incident is part of a wider compromise: Arara's parent Paycloud Holdings said on November 2 that about 380 corporate clients were affected and 77 million email addresses exposed, with names, phone numbers and addresses included for some clients. Criticity is high rather than critical because no CVE, no confirmed misuse and no threat actor are reported, but the leaked addresses give attackers a ready list for targeted phishing impersonating Sega and Sega Fave.
Detalhes técnicos
According to Arara's statement of October 29, an intruder gained access to certain server systems of its Arara Message email distribution service on October 28 after exploiting vulnerabilities in web servers. The service was suspended on October 31 and was still offline at the time of writing. The article does not name the vulnerable software, any CVE or the threat actor behind the intrusion.
Remediação
Sega urges customers not to open or reply to URLs or attachments in unrecognized emails, and says neither Sega nor Sega Fave will ask for passwords or credit card information by email; suspicious messages should be deleted without using their links. Organizations that send newsletters through third-party providers should confirm whether their subscriber lists were in the exposed set, warn recipients about impersonation, and review their supplier's handling of incident disclosure. Sega's and Arara's own notices were not opened during this research, so the vendor-side scope and remediation status are taken from the article.
Linha do tempo
-
Sega confirms 2.2 million newsletter email addresses leaked via breach at email provider Arara
ler a análise desta fonte ocultar
On November 9, Sega disclosed that an unauthorized third party leaked about 2.2 million customer email addresses after gaining access to Arara Inc., a Japanese email delivery provider that Sega used to distribute its newsletters. The breach covers 2,196,044 addresses for various newsletters and 92,273 distribution-related items. Sega says the leak does not include names, dates of birth, genders, postal addresses, phone numbers, credit card data or passwords, and no misuse has been confirmed. The incident is part of a wider compromise: Arara's parent Paycloud Holdings said on November 2 that about 380 corporate clients were affected and 77 million email addresses exposed, with names, phone numbers and addresses included for some clients. Criticity is high rather than critical because no CVE, no confirmed misuse and no threat actor are reported, but the leaked addresses give attackers a ready list for targeted phishing impersonating Sega and Sega Fave.
Technical Details
According to Arara's statement of October 29, an intruder gained access to certain server systems of its Arara Message email distribution service on October 28 after exploiting vulnerabilities in web servers. The service was suspended on October 31 and was still offline at the time of writing. The article does not name the vulnerable software, any CVE or the threat actor behind the intrusion.
Remediation
Sega urges customers not to open or reply to URLs or attachments in unrecognized emails, and says neither Sega nor Sega Fave will ask for passwords or credit card information by email; suspicious messages should be deleted without using their links. Organizations that send newsletters through third-party providers should confirm whether their subscriber lists were in the exposed set, warn recipients about impersonation, and review their supplier's handling of incident disclosure. Sega's and Arara's own notices were not opened during this research, so the vendor-side scope and remediation status are taken from the article.