Sega says 2.2M customer emails exposed in Arara vendor breach

What happened

According to Infosecurity Magazine, Sega says that around 2.2 million customer email addresses were exposed through a third-party incident. The report says Sega disclosed on November 9 that an unauthorized third party leaked the addresses after gaining access to Arara Inc., a Japanese email delivery provider that Sega uses to send its email newsletter. These are claims by Sega and Arara as relayed by one outlet; no independent verification is mentioned.

Per the same report, the Japanese firm said the breach is limited to 2.196 million email addresses for various email newsletters, and 92,273 items related to distribution. Infosecurity Magazine does not make clear whether “the Japanese firm” means Sega or Arara.

Infosecurity Magazine says Arara stated on October 29 that unauthorized access to certain server systems of its email distribution service occurred a day earlier, on October 28, after a hacker exploited vulnerabilities in web servers. The vulnerabilities are not identified in the article. The service, called Arara Message, was suspended on October 31 and, according to Arara’s incident page as cited by the article, remained offline at the time of writing.

The article also cites a report by The Japan Times saying that Arara’s parent company, Paycloud Holdings, confirmed on November 2 that hackers accessed servers operated by the subsidiary. Per that report, this exposed information held by around 380 corporate clients, including 77 million email addresses. Depending on the company, the data also included names, telephone numbers and addresses, and Paycloud said no credit card details were exposed. We have not seen The Japan Times report ourselves.

Not confirmed: the cause of the unauthorized access, which vulnerabilities were used, and the full scope of the leaked data. Sega says it is working with Arara and related companies to confirm the details.

Am I affected?

You may be affected if you subscribed to a Sega email newsletter. Whether a specific address is among those exposed is not confirmed in the source, and the article does not describe a way to check.

According to the report, Sega says the leaked information does not include customer names, dates of birth, genders, addresses, phone numbers, credit card information or login passwords. Sega says no misuse of the leaked data has been confirmed so far. Sega has warned of suspicious emails purporting to be from Sega or Sega Fave Corporation, or using product or service names operated by either company.

What to do now

1. Treat unexpected emails that claim to come from Sega or Sega Fave with caution, as Sega advises.
2. Do not open or reply to URLs or attachments in emails you do not recognize. Sega says this could lead to entering personal information or affecting your device.
3. Remember that, per Sega, neither it nor Sega Fave will ask for your password or credit card information by email. If you get such an email, do not use the link or reply; delete it.
4. Watch for further updates from Sega and from Arara’s incident page, since the investigation is still under way and details may change.

Sources

• Infosecurity Magazine: Email Addresses of 2.2 Million Sega Customers Leaked in Vendor Breach