Sega has revealed that around 2.2 million customer email addresses have been exposed as result of a third-party incident.
The video gaming giant revealed on November 9 that an unauthorized third party leaked the email addresses after gaining access to Arara Inc., a Japanese email delivery provider used by Sega to distribute its email newsletter.
“We deeply apologize for the great inconvenience and concern caused to our customers and all parties involved,” Sega wrote.
“Currently, Arara is working to identify the causes of unauthorized access and prevent further damage, and we are working with Arara and related companies to confirm the details of the leaked information.”
The Japanese firm said the breach is limited to 2.196 million email addresses for various email newsletters, and 92,273 items related to distribution.
The leaked information does not include customer names, dates of birth, genders, addresses, phone numbers, credit card information or login passwords.
No misuse of the leaked data has been currently confirmed. However, Sega has warned customers to be vigilant for suspicious emails purporting to be from Sega or Sega Fave Corporation, or using product or service names operated by both companies.
Sega Fave is a subsidiary of the broader Sega group, which focuses on the production of toys and arcade machines.
“Please do not open or reply to URLs or attachments provided in emails you do not recognize. Accessing URLs or opening attached files may lead to entering personal information or affecting your device. Neither our company nor Sega Fave will ask you for your password or credit card information by email. If you receive such an email, do not access the reply or the provided link; delete it,” the company said.
Sega Breach Part of Large-Scale Third-Party Incident
Arara revealed it had been compromised in a statement issued on October 29, which said that unauthorized access was gained to certain server systems of its email distribution service a day earlier, on October 28 after a hacker exploited vulnerabilities in web servers.
The distribution service ‘Arara Message’ was suspended on October 31 and remains offline at the time of writing, according to a dedicated incident page set up by the firm to provide updates.
According to a report by The Japan Times, Arara’s parent company Paycloud Holdings confirmed on November 2 that hackers gained unauthorized access to servers operated by the subsidiary, which exposed information held by around 380 corporate clients using the service. This included 77 million email addresses.
Paycloud also noted that depending on the company, the breached data also included names, telephone numbers and addresses. However, it said that no credit card details have been exposed.
Image credit: Bangla press / Shutterstock.com