SEGA Says 2.2 Million Newsletter Emails Leaked Through Its Mailing Vendor. Your Questions on the ARARA Breach, Answered
SEGA says a breach at its newsletter provider ARARA exposed 2.2 million subscriber email addresses across 11 newsletters. ARARA’s incident reportedly touched 77 million addresses from nearly 380 corporate clients, and attackers used the service to send more than 7 million fake credit-card emails.
When a company hands its mailing list to an outside email service, it also hands over part of its security. SEGA is learning that the hard way: the gaming company says millions of its newsletter subscribers were exposed, not through its own systems, but through the vendor that sends its newsletters.
The answers below are based on BleepingComputer’s report on the SEGA disclosure.
What did SEGA disclose?
SEGA says a breach at ARARA, the third-party provider that delivers its newsletters, exposed the email addresses of 2.2 million subscribers. Another 92,300 records include further information that is still being identified. Eleven newsletters tied to SEGA and SEGA Fave products and services are affected.
What was not exposed?
According to SEGA’s investigation, the leaked data did not include names, birth dates, gender, home addresses, phone numbers, credit card details or account passwords. Email addresses registered to a SEGA Account run through a separate system and were not involved. SEGA says it has no confirmed evidence of misuse so far and is working with ARARA to pin down exactly what was taken.
How big is the vendor’s breach?
Much bigger than SEGA. ARARA disclosed on November 2 that its email distribution service had been breached, compromising 77 million email addresses belonging to nearly 380 corporate clients. Other companies named in the report include MOS Burger with 7.5 million addresses, Shochiku Multiplex Theatres with 3.3 million records, TKC with 2.3 million addresses and IIJmio with nearly 1 million.
How did attackers get in?
ARARA has pointed to a web server vulnerability and problems in its system environment, but the exact entry point and timing are still under investigation.
Did the attackers do anything with the access?
Yes. ARARA says the intruders used its own sending platform to push out more than 7 million emails pretending to be from credit card companies in late October. Phishing that arrives through a legitimate mailing service is harder for filters and people to spot.
Why did SEGA’s notice take a while?
The vendor’s picture changed. ARARA initially estimated a smaller impact and told SEGA on October 29 that no data had been compromised. On November 3 it notified SEGA that data had in fact been exposed, and it shared full details between November 5 and 8.
Is this connected to SEGA’s arcade outage?
No. In a separate incident disclosed on November 2, SEGA Fave reported unauthorized access to servers behind its ALL.Net and Aime arcade network services and suspended them. Its early findings showed no evidence that customer or partner data was taken, and payment information was stored separately.
What this means for your company
Most small businesses use an outside service for newsletters, invoices or marketing email, and this story shows two risks that come with it: your customer list can leak from someone else’s server, and criminals can borrow a trusted sending platform to phish. Keep an inventory of every vendor that holds customer contact data, and ask each one how they protect it, how fast they will notify you, and whether they support multi-factor sign-in and access logging on your account. Send only the fields a vendor actually needs. Prepare a short customer notice in advance so you can warn people quickly if a vendor is breached. Finally, remind staff that a message coming from a familiar mailing service is not proof that it is genuine.
Want a clear list of which outside services hold your customer data, and what each would mean for you if it were breached? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
