Confirmed breach

Sega data breach

JPJapan

Infosecurity Magazine, SC Media and BleepingComputer reported a data breach at Sega (Japan) on 9 November 2026, and it has been confirmed. It affected 2,200,000 customers.

One of 2 organisations whose data was taken through Arara. The Arara breach →

What we know as of 11 November 2026

Status: Confirmed.
People affected: 2,200,000 customers.
What was exposed: Email addresses and Newsletter subscription data.
When: First reported 9 November 2026.
How: Hacking, through Arara.
Sega’s record: No earlier breach on record under this name.

Not known yet: when it began and who was behind it. This page is updated as notices and statements come in.

Every fact above has its source below. Journalists: free to quote with credit (“Privacy Unpacked data breach tracker”, with a link to this page and the date); the figures can move. Follow this breach (feed) · Every major breach · Ask us for a figure

People affected: 2,200,000customers
Reported: 9 November 2026News report and 9 more

Who is affected: People worldwide

What was exposed 2

Email addresses
Newsletter subscription data

How it happened

How: Hacking hackers compromised Japanese email delivery provider Arara source
Through: Arara Japanese email delivery provider Arara source · 2 organisations hit through Arara →
Way in: Arara Japanese email delivery provider Arara source

What changed since it was first reported

10 November 2026 Confirmed breach, 2,200,000 customers (SC Media)

Sources 10

News reportSC MediaSega reports email data breach following third-party incident9 November 2026 · 2,200,000 email addresses
Confirmed by Sega: Sega has confirmed a data breach
News reportfrenchbreachesSEGA victim of massive data breach affecting 2.2 million email addresses (our translation from French)10 November 2026 · 2,200,000 email addresses
Confirmed by SEGA: SEGA confirms a data breach
Our translation from French
SEGA confirme une fuite de données
News reportAndroid HeadlinesSEGA confirms newsletter data breach, exposing 2.2 million users10 November 2026 · 2,200,000 users
Confirmed by SEGA: SEGA has confirmed a data breach of its newsletter
News reportTelset.idSega Data Breach: 2.2 Million Customer Emails Leaked via Third Party (our translation from Indonesian)10 November 2026 · 2,196,044 email addresses
Confirmed by Sega: Sega Corporation uses the Arara Corporation email distribution system to distribute certain newsletters related to our company's products and services and our group company, Sega Fave Corporation. It was recently discovered that Arara Inc. experienced unauthorized access by a third party, and the address
Our translation from Indonesian
Sega Corporation menggunakan sistem distribusi Arara Corporation untuk mendistribusikan newsletter email tertentu terkait produk dan layanan perusahaan kami dan perusahaan grupnya, Sega Fave Corporation. Baru-baru ini ditemukan bahwa Arara Inc. mengalami akses tidak sah oleh pihak ketiga, dan alamat

Show all 10 sources

News reportSohuSEGA confirms 2.2 million email address leak incident, third-party service provider ARARA becomes focal point (our translation from Chinese)11 November 2026 · 2,200,000 email subscribers
Confirmed by SEGA: SEGA officially confirmed that email addresses of approximately 2.2 million newsletter subscribers were leaked
Our translation from Chinese
SEGA 官方确认，约 220万名时事通讯订阅者的电子邮箱地址遭到泄露
News reportCybernewsSEGA confirms data breach exposing 2.2M email addresses11 November 2026
Confirmed by SEGA: SEGA confirms data breach
News reportInfosecurity MagazineEmail Addresses of 2.2 Million Sega Customers Leaked in Vendor Breach9 November 2026 · 2,200,000 customers
News reportBleepingComputerSEGA newsletter data breach exposes 2.2 million email addresses9 November 2026 · 2,200,000 email addresses
Archived copy Wayback Machine, 10 November 2026
News reportNintenderosSEGA newsletter data breach exposes 2.2 million email addresses (our translation from Spanish)10 November 2026 · 2,200,000 email addresses
News reportSempreUpdateSEGA data breach exposes 2.2 million emails (our translation from Portuguese)10 November 2026 · 2,200,000 email addresses

News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes

If Sega had your data

Look for Sega’s own notice or letter: it should say what of yours was involved. Keep it.
Your email address is out: expect convincing phishing. Open Sega by typing its address yourself, never through a link in an email or text, and check the sender before you reply.
Expect scams that use your details: calls, texts or emails pretending to be Sega, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

Use Sega? Hear first next time

Breach Radar tells you when a company you use is breached, and what to do. Free, and your list stays on your phone.

Download on the App Store

Questions about the Sega breach

Was Sega hacked?

Infosecurity Magazine, SC Media and BleepingComputer reported a data breach at Sega (Japan) on 9 November 2026, and it has been confirmed. It affected 2,200,000 customers. How it happened, by the sources: hacking, through Arara.

What data was exposed in the Sega breach?

Email addresses and Newsletter subscription data, by the notices and reports on this page.

How do I know if I was affected?

Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.

Is there a Sega data breach settlement?

No settlement open for claims is on record for Sega as of 15 November 2026. Every open settlement is listed with its deadline.

Is a letter, email or text about the Sega breach real or a scam?

A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Sega’s own site, or check the letter here.

More breaches in Japan

Every breach in Japan →

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.