Privacy Unpacked
Menu

Incident · one vendor, 2 organisations

The Arara breach

9 November 2026 to 13 November 2026

2 organisations on the tracker had data taken through Arara. Each one is listed with the words of the source that names Arara.

AraraSega: 2,200,000 customersSegaCity of Osaka: 1,000,000 email addressesCity of Osaka AraraSega: 2,200,000 customersCity of Osaka: 1,000,000 email addresses
Arara in the middle; around it, the 2 organisations that had data taken through it, each sized by the people it notified (a dot with no count is the smallest). Each one links to its page.

Organisations affected through Arara

  1. SegaJPJapan · 9 November 2026 Email addressesNewsletter subscription data 2.2Mcustomers
    Japanese email delivery provider Arara Infosecurity Magazine
  2. City of OsakareportedJPJapan · 13 November 2026 Email addresses 1Memail addresses
    hackers accessed the Arara email distribution service used by TKC Corporation The Record

Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Arara as the way its data was taken.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.