SEGA says 2.19 million newsletter email addresses leaked via a contractor
Unauthorized access hit the Arara Message delivery service. SEGA says passwords and payment data were not exposed.
Leaked on 09 November 2026
SEGA disclosed that unauthorized access to Arara Message, the email delivery service it used for newsletters, leaked 2,196,044 email addresses, Game*Spark reported on November 9. Hackmanac (@H4ckmanac) flagged the disclosure on X.
Of those, 92,273 also included "information associated with the distribution," Game*Spark says. SEGA confirmed that names, dates of birth, addresses, phone numbers, credit card information and login passwords were not compromised, and that SEGA Account email addresses are not affected.
SEGA disclosed the breach itself. The investigation with Arara is ongoing.