Coverage from Infosecurity Magazine indicates that Sega has confirmed a data breach involving approximately 2.2 million customer email addresses.
The incident occurred after an unauthorized third party gained access to Arara Inc., a Japanese email delivery provider used by Sega for newsletter distribution. The breach, disclosed on Nov. 9, affected 2.196 million email addresses and over 92,000 distribution-related items. Sega stated that no sensitive information such as names, passwords or credit card details was compromised. Arara reported the initial server compromise on Oct. 29, noting that hackers exploited vulnerabilities in its web servers on Oct. 28. The parent company, Paycloud Holdings, confirmed that the incident impacted roughly 380 corporate clients, potentially exposing 77 million email addresses in total. While no misuse of the data has been confirmed, Sega has urged customers to remain vigilant against phishing attempts. The company emphasized that it will never request passwords or financial information via email. The Arara Message service was suspended on Oct. 31 and remains offline as investigations continue. This event highlights the ongoing risks associated with third-party service providers and the importance of robust supply chain security measures for large organizations.
Source: Infosecurity Magazine
