A vendor breach at ARARA, the mailing house that distributes SEGA’s newsletter, left 2.2 million subscriber email addresses exposed, the gaming company has confirmed.
What was not exposed
SEGA’s investigation found no customer names, birth dates, gender, postal addresses, phone numbers, card details or account passwords in the stolen set, and addresses tied to a SEGA Account live on a separate system the incident did not touch. Another 92,300 records carried information the company has yet to characterize.
The sequence is the part worth studying. The mailing house itself went public on November 2 about an intrusion that had reached 77 million addresses across nearly 380 corporate clients. On October 29 it had assured SEGA nothing was compromised; only on November 3 did it concede data had leaked, sharing full detail between November 5 and 8.
ARARA blames a web server vulnerability compounded by weaknesses in its own system environment, though how the intruders got in and when remain under review. The same access was used in late October to blast north of 7 million messages posing as credit card companies.
MOS Burger lost 7.5 million addresses to the same campaign. Shochiku Multiplex Theatres logged 3.3 million records, TKC 2.3 million addresses, IIJmio close to 1 million.
Separately, SEGA Fave’s arcade network remains offline after an intrusion disclosed November 2 that took down online play, SEGA Lucky Kuji Online and new ID signups for maintenance and safety checks. SEGA says the two events are unconnected.
For subscribers, the live risk is phishing built on a genuine vendor relationship. Treat any mail citing the newsletter as hostile until proven otherwise.
