SEGA Reports Email Address Leak Affecting 2,196,044 Newsletter Recipients
Arara is investigating unauthorized access to the distribution system used by SEGA and SEGA Fave.
SEGA confirmed that a third party accessed its newsletter provider’s systems, exposing 2,196,044 email addresses. Addresses registered through SEGA Accounts are unaffected.
SEGA reported the leak on Monday after an unnamed third party accessed systems operated by Arara. The provider distributes email newsletters for SEGA and SEGA Fave.
Arara is investigating the cause of the unauthorized access and taking steps to prevent further damage.
The leak affected 11 newsletters sent in July, September, and October. Of the 2,196,044 exposed email addresses, 92,273 also had associated newsletter delivery information leaked.
At the time of its announcement, SEGA said it had found no indication that the following customer information had leaked:
- Names
- Birthdates
- Genders
- Postal addresses
- Phone numbers
- Credit card information
- Login passwords
Email addresses registered through SEGA Accounts use a different distribution system. SEGA said those addresses are unaffected.
Six affected newsletters concern the SEGA Lucky Kuji Online prize game service. That service is already undergoing maintenance for security checks following a separate incident involving SEGA Fave’s arcade game network services.
SEGA Fave announced on November 2 that a third party had accessed its servers without authorization. That incident is unrelated to the newsletter leak.
The affected servers support the ALL.Net arcade game network service and Aime, whose cards let certain arcade games store player information.
SEGA Fave suspended various related services on November 1 for security checks. Services for some games remain unavailable.
SEGA and other companies, including Bandai Namco, use the affected services for certain arcade games.
