Sega has confirmed that 2,196,044 customer email addresses were taken when attackers broke into Arara, the Japanese company that sent its newsletters. Sega is one of roughly 380 corporate clients caught up in the Arara incident, which shows how a single marketing supplier can expose the mailing lists of hundreds of brands at once.
What happened
On 9 November 2026 Sega disclosed that its newsletter mailing list had leaked through a breach at Arara Inc., the company behind the Arara Message email distribution platform. Sega puts the exposure at 2,196,044 email addresses plus 92,273 items it describes as related to distribution. It says names, dates of birth, gender, postal addresses, phone numbers, payment card details and login passwords were not part of the leak, and that it has not yet seen any misuse.
The affected lists carried Sega and Sega Fave newsletters sent between July and October. Addresses registered to a SEGA Account go out through a separate system and are not affected, according to the company.
The timeline, as reported by GBHackers, shows how slowly the picture came together for a downstream customer. Sega raised a possible incident with Arara on 29 October and heard that nothing had yet been confirmed. Arara then made a public announcement, confirmed to Sega on 3 November that its addresses were involved, and Sega ran its own checks from 5 to 8 November before going public. Arara also revised its own account: data theft is now said to have run from 28 October until the service was shut down at 14:50 on 31 October, not ending on 29 October as first stated.
Sega is far from the only victim. According to Infosecurity Magazine, citing The Japan Times, Paycloud Holdings, which owns Arara, said on 2 November that around 380 corporate clients were affected, with 77 million email addresses exposed. TechRadar gives a higher figure of more than 81 million addresses across 97 servers. It also names other affected clients, including Bic Camera and MOS Burger. For some clients the stolen records also held names, phone numbers and postal addresses. No card data was involved, according to Paycloud.
A separate intrusion at Sega Fave’s arcade network servers is unrelated, the company says.
The technical picture
The technical detail published so far is limited. Arara’s notice, as reported by GBHackers and Infosecurity Magazine, says the attacker got in by exploiting a vulnerability in its web servers. TechRadar adds that unspecified “other system weaknesses” also played a part. No CVE, no named product and no threat actor have been disclosed, and nobody has publicly claimed the attack.
The detail that worries me most comes from TechRadar. It reports that the attackers also reached a separate environment holding a further 3.38 million addresses. It says they used the platform to send more than seven million phishing emails posing as credit card companies, which forced the shutdown on 31 October. Only TechRadar reports this, so treat it with some caution.
A bulk email platform holds more than a list of addresses. It also holds the sending reputation, the authenticated domains and the trust that each brand has built with its subscribers. A message sent through a legitimate provider using a client’s configuration can pass the checks that would normally catch a spoof. For an attacker, a compromised sending platform is worth more than a stolen spreadsheet.
Why it matters for UK organisations
None of the sources say UK residents are among those affected. Arara’s client base appears to be overwhelmingly Japanese. The lesson for UK organisations is structural, not about who was hit.
Almost every UK retailer, charity, publisher and membership body hands its customer list to a third-party email service provider. Under UK GDPR, that provider is normally a processor acting for you as controller. Article 28 requires a written contract that covers security, sub-processors, assistance with breaches and the return or deletion of data. Article 33 requires the processor to tell the controller about a breach without undue delay. The controller then has 72 hours from becoming aware to notify the ICO where the breach poses a risk to individuals.
Sega’s timeline shows the gap that can open up between those duties. A customer that asks early and hears “nothing confirmed yet” may lose days before it can assess its own exposure. If your contract does not set deadlines for incident updates, you are relying on goodwill.
Email lists seem to be treated as low-risk marketing assets rather than personal data. In my experience, that is often why they sit with suppliers who get little scrutiny.
Expert view
When we assess supplier risk for clients, the email platform is often the tool the marketing team bought on a card years ago. Nobody in security has looked at it since. Single sign-on is often missing and old API keys linger.
An exposed address on its own sounds minor. But an address plus the knowledge that the person subscribes to a particular brand is exactly what a convincing phish needs. Combine that with a platform that can send authenticated mail, and the risk moves from embarrassment to fraud.
The other point is aggregation. One web server weakness at one supplier became an incident for about 380 companies. UK organisations should expect regulators to ask how they chose and monitored their processors, not just whether the processor was to blame.
What to do now
- Find your email platforms. List every service that sends mail on your behalf, including ones bought by marketing, events or fundraising teams, and record what personal data each one holds.
- Check the contract. Confirm an Article 28 agreement is in place, with a fixed deadline for breach notification and a duty to keep you updated as the facts change.
- Cut what you store. Remove dormant subscribers and fields you do not need. Data a supplier does not hold cannot be leaked.
- Lock down access. Enforce single sign-on or MFA on supplier consoles, rotate API keys and remove leavers. This maps to the user access control requirements in Cyber Essentials.
- Limit sending authority. Review which providers are authorised in your SPF and DKIM records, use DMARC enforcement, and remove providers you no longer use.
- Ask about patching. Ask key suppliers how they handle security updates and secure configuration on internet-facing servers. These are the Cyber Essentials controls most relevant to the reported entry point.
- Prepare a customer message. Draft a warning in advance so that, if a supplier is breached, you can quickly tell subscribers what you will and will not ask them for by email.
Bottom line
Sega lost a mailing list, not passwords or payment data, but that is not the main story. One compromised email supplier exposed tens of millions of addresses across hundreds of brands and, according to one report, was used to send phishing emails. UK organisations should treat their email service providers as processors of personal data. That means proper contracts, tight access controls and clear rules on how fast a supplier must report a breach.
