TL;DR
- Sega confirmed on November 9 that attackers stole 2,196,044 customer email addresses.
- The breach started at newsletter vendor Arara Message, not in Sega’s own login systems.
- Sega says passwords and credit-card details were not in the leak.
- Watch for phishing that poses as Sega, Sega Fave, or the vendor.
Sega confirmed on November 9 that attackers stole 2,196,044 customer email addresses from a contractor that sends some of its newsletters. Sega and its group company Sega Fave used the Japanese delivery service Arara Message for those mailings. Sega is warning customers to watch for phishing that pretends to come from Sega, Sega Fave, or the vendor itself.
The leaked records are email addresses. A subset of 92,273 also includes other information tied to the mailings. Sega is still working with the vendor to determine what that extra data contains. The company says names, dates of birth, gender, postal addresses, phone numbers, credit-card details, and login passwords were not in the leak. Addresses registered to a SEGA Account sit on a different delivery system. Those addresses were not part of this incident. As of November 9, Sega has not confirmed any misuse of the stolen addresses.
The breach did not start inside Sega's own login systems. It started at a third-party newsletter vendor. That is the part that should matter to any business that outsources email or marketing. Sega asked the vendor on October 29 about the safety of its newsletter delivery. The vendor reported that no leak had been found. On November 1, after the vendor publicly reported unauthorized access, Sega asked again. On November 3, the vendor confirmed that the newsletter addresses had been taken.
The same incident reached far beyond one company. On November 6, Arara's parent, Paycloud Holdings, said 81,329,467 email addresses had been taken from the service, after duplicates were removed. It estimated that up to about 380 client companies could be involved. Those figures are still under review. They are not Sega's count.
Attackers also used the delivery platform to send up to about 7.13 million emails that impersonated credit-card companies. Those messages went out from news@arara.com between October 28 and 30. The vendor says they used addresses the attackers brought in from outside. The mail still shows what can follow a vendor breach. It looks official. It uses a familiar brand. It asks the reader to click.
Sega says no one should open unexpected links or attachments. No one should reply to those messages. Sega and Sega Fave will not ask for a password or a credit-card number by email. The vendor has said the same. For East Texas businesses, the practical test is simple. Treat a sudden "verify your account" or "your data was involved" message with extra care. Be especially careful if it names a brand you recently heard from. Report suspicious mail in Microsoft 365 with the Report phishing action. That gives Microsoft Defender a sample it can use. Keep multifactor authentication turned on. Then review which vendors hold your customer email lists. Ask how quickly each one would tell you if those lists were exposed.
Brownsboro businesses can ask veteran-owned My I.T. Consultants for a Free Assessment of email security and vendor risk. Call 903-675-5431 Monday through Friday from 7:00 a.m. to 6:00 p.m.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
