ARARA, the Email Service Behind SEGA's Newsletters, Says 77 Million Addresses Were Taken and Its Own Sender Mailed Up to 7.1 Million Card Phishing Emails. 2.2 Million of the Addresses Are SEGA's
If you ever signed up for a Japanese company's newsletter, including SEGA's, and you get an email about your "card statement" or "usage details" that you did not expect, do not click it. ARARA, a Japanese email delivery company, says an attacker took data from its mail service and then used the service itself to send phishing emails that pretended to come from a credit card company. The service has been switched off since October 31. SEGA said on November 9 that 2,196,044 of its newsletter addresses were in the stolen data.
What has been reported
The primary sources are ARARA's second report of November 2 (a five-page PDF, which we downloaded and read in Japanese) and SEGA's notice of November 9, which an outside agent read in Japanese for us. The Japanese-language figures below are our translation. BleepingComputer's report of November 9 matches them and adds nothing we could not find in the originals.
Scale, per ARARA: about 77 million email addresses taken or possibly taken, from servers serving up to about 380 contracting companies. ARARA says this is under review and is a count of addresses, not people, because one person can hold several addresses.
Two separate intrusions, per ARARA: an earlier one on October 27 to 28 in a shared environment, where someone logged into an administration screen and used its data export function (3,386,187 addresses, 61 companies), and a larger one from October 28 to 31 that moved through the service's own servers into 97 customer servers.
What was taken: in the larger intrusion, email addresses plus whatever each customer stored: names, gender, date of birth, phone number, membership number and address, depending on the company. ARARA says it holds no credit card numbers.
The phishing: from October 28 to 30, up to about 7.13 million emails posing as a credit card company went out through two of ARARA's environments, from the sender [email protected], with subject lines such as "Request to confirm usage details." ARARA says they were sent to addresses the attacker brought in from outside.
Cause, per ARARA: a web server vulnerability plus problems in the system environment. It has not said which vulnerability, or how the attacker first got in.
Response: all service stopped on October 31 at 19:53. ARARA says customers will have to reset administration passwords and API keys before it reopens, with no date. It reported to Japan's Personal Information Protection Commission and to police.
SEGA: its notice says 2,196,044 addresses were exposed from newsletters sent between July 2 and October 28, and that 92,273 of those also carry delivery-related information that is still being investigated. SEGA says names, dates of birth, addresses, phone numbers, card details and login passwords were not included, and that SEGA Account addresses sit on a different system. It says no misuse is confirmed, and that it will notify customers individually once the data is confirmed.
What it means
The pattern is a supplier holding other companies' customers. SEGA's own systems were not named as breached. A company that never held a card number or a password for these subscribers still gave an attacker 2.2 million email addresses, because a vendor held them. And the more useful thing to the attacker was the vendor's own mail pipe: phishing sent from a real sender, to real addresses, at scale.
What to do
If you subscribed to a newsletter from a Japanese company in the last year, treat unexpected "card", "statement" or "confirm your usage" email as hostile, even if the sender name looks like one you know. Go to the card company's own app or site instead.
If you got a message from [email protected] between October 28 and 30 with a subject like the ones above, do not open the link. If you entered card details, call the card issuer.
SEGA customers: SEGA says it never asks for passwords or card details by email. Expect more targeted phishing that mentions SEGA or a game you follow.
If you are a company that uses a mail delivery vendor, ask the vendor now: could an attacker with its administration screen export your list in one action, is multi-factor authentication required there, and would you hear about an intrusion in hours rather than days?
Keep a record of exactly which lists you sent through which vendor. Without it you cannot tell your customers whether they are involved.
Rotate the API keys and administration passwords you hold with any mail vendor that has had an incident, whether or not it has asked you to.
What is not known
Which web server flaw was used, and how the attacker first got in. Who the attacker is: ARARA says only that the intrusions look like one party, on the grounds of common attack sources. The final number of addresses and companies. Which other companies beyond SEGA are affected; ARARA says it is telling its customers individually. What the 92,273 delivery-related records contain. We found no published indicators, so we add nothing to our feed. The sender [email protected] is a real company address that was abused, and it is not something to block.
How we know, and how we checked
We read ARARA's November 2 report in full in Japanese and used SEGA's November 9 notice as read for us in translation by an agent. We did not read ARARA's first report of October 29 directly, and it is the source of the earlier 3.01 million figure that the second report revises. We did not examine any phishing sample or test anything. A search of our corpus found no earlier post of ours on ARARA or this SEGA incident.
Sources
ARARA Co., Ltd., "Unauthorized access to Arara Message and the service stop (second report)," November 2, 2026. SEGA Co., Ltd., notice on the leak of personal information through unauthorized access at an outsourced company, November 9, 2026. BleepingComputer, "SEGA newsletter data breach exposes 2.2 million email addresses," November 9, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments