SEGA confirms 2.2 million email leak: what happened and what to do
An attack on ARARA, the company that sent SEGA's newsletters, has exposed 2.2 million email addresses. No passwords or credit cards were compromised, but it's a good idea to be on the lookout for phishing attempts.
Translated automatically from Spanish. Read the original
SEGA has confirmed a leak affecting around 2.2 million email addresses of its newsletter subscribers. The attack was not against SEGA, but against ARARA, the Japanese company that managed the sending of newsletters. SEGA assures that no passwords, cards, or personal data such as names or addresses have been leaked.
What has been leaked
- 2,196,044 records with email addresses.
- Affects 11 newsletters from SEGA and SEGA Fave, its amusement arcade division.
- In 92,273 of these records, there was additional information that is still being investigated.
Have not been leaked, according to SEGA:
- Names, dates of birth, or addresses.
- Phone numbers.
- Credit cards.
- Account passwords.
A much larger attack
The problem goes beyond SEGA. ARARA acknowledged on November 2 that the attack affected around 77 million emails from nearly 380 companies that used its service. Additionally, the attackers used the platform to send over 7 million fake emails impersonating credit card companies at the end of October.
What SEGA has done
- Has suspended the newsletters it sent with ARARA.
- Will individually notify those affected.
- Will report it to the Japanese data protection authority.
- Says that there is no evidence that the data has been used, for now.
SEGA clarifies that this leak is different from the incident that affected the servers of SEGA Fave's amusement arcade network.
What you need to do if you were subscribed
- Be wary of unexpected emails that claim to be from SEGA, your bank, or your credit card, especially if they ask for data or payments.
- Do not click on links from suspicious emails: enter the official website directly.
- If you use the same password on several sites, change it and activate two-factor verification.
- You can check if your email appears in leaks on Have I Been Pwned.
Frequently asked questions
Has my SEGA account been stolen? There are no indications. Only email addresses from the newsletters were leaked, without passwords.
Does it affect Steam, PlayStation, or Xbox? No. It is a leak of SEGA's newsletters, not the game stores.
What is ARARA? A Japanese company that sends mass emails, used by SEGA and 380 other companies.
Sources: SEGA, eSecurity Planet, Cybernews, Teiss, and Privacy Guides.
Comments
Sign in to comment
No comments yet. Start the conversation.