If you subscribed to a SEGA or SEGA Fave newsletter, assume your email address is now in criminals' hands and treat any message claiming to be from SEGA or its mailer ARARA with suspicion. SEGA confirmed on November 9, 2026 that 2,196,044 newsletter email addresses were stolen from ARARA. Passwords, payment cards, names and addresses were not exposed.
Worried you're exposed? Find out in 60 seconds with a free exposure scan.
Run a free scanWhat Happened in the SEGA Data Breach
SEGA did not get hacked directly. The breach happened at ARARA, a Japanese company that runs the email distribution system SEGA used to send its newsletters. ARARA disclosed an intrusion into that service on November 1 and 2, 2026, saying a third party had gained unauthorized access and that email addresses belonging to customers of hundreds of its corporate clients were taken. On November 3 ARARA confirmed to SEGA that SEGA's newsletter list was among the stolen data, and SEGA published its own notice on November 9, 2026.
SEGA says the exposed addresses were collected for 11 SEGA and SEGA Fave newsletters. It has suspended newsletter sending through ARARA's system until the platform's safety can be verified, and says it has seen no evidence so far that the leaked data has been misused.
This is a textbook third-party vendor breach: you trusted one brand, but your data sat with a supplier you had never heard of.
What Data Was Exposed
- Email addresses: 2,196,044 addresses tied to SEGA and SEGA Fave newsletter subscriptions
- Delivery-related information: roughly 92,000 of the records also included additional delivery data that SEGA says is still under investigation
According to SEGA, the following were not exposed: names, dates of birth, postal addresses, phone numbers, payment card details and passwords. Email addresses registered to SEGA Accounts are handled by a separate system and were not affected.
The real risk is phishing
An email address on its own cannot empty your bank account, but it tells scammers that you are a SEGA customer. Expect fake "account verification", "refund", "free game" or "security notice" emails using SEGA or ARARA branding. SEGA has specifically warned subscribers to watch for messages impersonating SEGA or ARARA. Never sign in or enter payment details through a link in an unexpected email.
Step 1 of 6: Confirm Whether You Were Affected
If you ever signed up for a SEGA or SEGA Fave newsletter, assume you are affected; SEGA has not published a lookup tool. You can also check your address at Have I Been Pwned, which tracks large leaks of email addresses, and run a broader dark web check to see whether the same address has turned up in other breaches.
Step 2 of 6: Treat SEGA-Themed Emails as Suspicious
- Do not click links or open attachments in unexpected emails about your SEGA account, purchases or prizes.
- Go to SEGA's websites or your platform store (Steam, PlayStation, Xbox, Nintendo) directly by typing the address yourself.
- Check the sender's real address, not just the display name, and be wary of urgency ("your account will be closed in 24 hours").
- Learn the warning signs of AI-generated phishing, which no longer has the spelling mistakes people used to rely on.
Step 3 of 6: Secure the Email Account Itself
Your email address is the key to every password reset you will ever do. Make sure the account behind it has a long, unique password and two-factor authentication, ideally with an authenticator app or passkey rather than SMS. If you reused your email password anywhere else, change it now. Our guide to recovering a hacked email account covers what to do if you see sign-ins you do not recognize.
Step 4 of 6: Protect Your Gaming Accounts
Gaming accounts are a favourite target because stored balances, skins and linked cards can be resold. Turn on two-factor authentication for Steam Guard, your PlayStation Network, Xbox and Nintendo accounts, and remove saved payment cards you no longer use. These steps cost nothing and block most account takeovers that start with a phishing email.
Step 5 of 6: Use Email Aliases for Newsletters From Now On
This breach is a good reason to stop giving your main inbox to every brand you like. An email alias forwards to your real inbox but can be switched off the moment it leaks or starts receiving spam, and it shows you exactly which company lost it.
Step 6 of 6: Shrink the Rest of Your Exposure
Scammers rarely stop at an email address. They combine leaked addresses with the names, phone numbers, home addresses and relatives that people-search sites and data brokers publish openly, which turns a generic phishing email into a convincing, personalized one. Removing yourself from those sites makes your leaked email far less useful. PrivacyOn removes your information from 100+ broker sites, keeps re-checking for it, and watches the dark web for your email and passwords. See how it compares in our roundup of the best data removal services.
See what scammers can find about you
PrivacyOn's free scan shows which people-search sites list your name, address and phone number, and its dark web alerts tell you when your email appears in a new leak. Plans start at $8.33/month and cover up to 5 people. Run a free PrivacyOn scan.
Free scan
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Frequently Asked Questions
Was SEGA hacked?
Not directly. The breach happened at ARARA, the third-party company that ran SEGA's newsletter email system. An attacker accessed ARARA's email distribution service and took subscriber addresses belonging to many of its clients, including 2,196,044 SEGA and SEGA Fave newsletter addresses.
Were SEGA passwords or credit cards leaked?
No. SEGA says passwords, payment card details, names, dates of birth, postal addresses and phone numbers were not part of the stolen data, and SEGA Account email addresses were stored separately and not affected. You do not need to replace a card because of this breach, but changing a reused password is still sensible.
Do I need to do anything if my email was in the SEGA breach?
Yes, but it is simple: be suspicious of emails that mention SEGA or ARARA, make sure your email account has a unique password and two-factor authentication, and turn on two-factor authentication for your gaming accounts. Those steps neutralize the main risk, which is phishing.
What is the ARARA data breach?
ARARA is a Japanese email marketing provider that disclosed in early November 2026 that its email distribution service had been breached, exposing tens of millions of email addresses belonging to customers of hundreds of its corporate clients. SEGA is the best-known brand confirmed to be affected so far.
How can I protect myself from future data breaches like this?
Use a separate email alias for newsletters and shopping, keep two-factor authentication on, and reduce how much of your personal information is publicly available. PrivacyOn removes your data from 100+ broker sites and alerts you when your details appear on the dark web, so a single leaked email is much harder to turn into fraud.