SEGA says a breach at its third-party email provider ARARA exposed 2,196,044 email addresses used for 11 newsletters linked to SEGA and SEGA Fave products and services. The company said 92,273 of the records also included additional information associated with mailings, which it is still investigating.
In its November 9 notice, SEGA said the exposed data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details or login passwords. Email addresses registered to a SEGA Account were not affected because they use a separate distribution system. SEGA said it has no confirmed evidence that the leaked information has been misused.
ARARA’s November 6 third report revised the platform-wide exposure total to 81,329,467 email addresses after adding a separate cloud environment and removing duplicate addresses. The company said the total could involve up to 380 client companies and does not represent a count of people or SEGA-specific records. ARARA also said attackers used the service to send up to 7.13 million suspicious emails impersonating credit card companies between October 28 and 30. Its November 6 incident update says the service remains suspended while the investigation continues.
SEGA said it was first notified on November 3 that its newsletter addresses had been exposed and received ARARA’s formal report between November 5 and 8. The company has stopped using ARARA Message for newsletters while it confirms the scope of the exposure and said it will contact affected subscribers individually when the review is complete. Its November 9 statement also clarified that the breach is separate from an earlier unauthorized-access incident involving SEGA Fave’s arcade network services.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
