What data was exposed?
In its November 9 notice, SEGA said 2,196,044 newsletter addresses were exposed. Of those, 92,273 also had mailing-related data attached. SEGA and Arara are still determining what that data contains. SEGA said names, phone numbers, card details and passwords were outside the exposed data.
Who may hear from SEGA?
The incident concerns recipients of certain SEGA and SEGA FAVE newsletters sent between July 2 and October 28, 2026, including arcade, Lucky Kuji and Tokyo Game Show mailings. SEGA Account emails use a separate mailing system and were outside the incident. SEGA plans to notify affected people once it has verified the details. SEGA has also paused the mailings sent through Arara.
Watch for impersonation emails
SEGA said it had found no misuse as of its notice. It advised recipients to avoid suspicious links and attachments and said it would never ask for passwords or card details by email.
Sources · SEGA notice
