--- title: "ARARA Message email-data incident" description: "ARARA confirmed theft of 81,329,467 email addresses across cloud environments, with SEGA among affected newsletter customers." incident_type: "Data incident" status: "active" last_modified: "2026-11-10" canonical_url: "https://www.ally.security/incidents/arara-message-email-data-incident-2026" markdown_url: "https://www.ally.security/incidents/arara-message-email-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/arara-message-email-data-incident-2026/stix.json" --- # ARARA Message email-data incident ARARA Message remained suspended after a revised count identified about 81.3 million exposed email addresses. Last modified Nov 10, 2026 · 3 sources ## Summary - **Environment:** ARARA Message email delivery and cloud environments - **Operational impact:** Email delivery suspended; restart date unresolved - **Financial impact:** No confirmed incident cost quantified ## What happened [ARARA](https://www.arara.com/) confirmed data theft from its Message email-delivery service during October 28–31, 2026. Its [third report](https://www.arara.com/dcms_media/other/arara_20261106_.pdf) added a second cloud environment to the same intrusion sequence. [2](#source-2) ## Impact - ARARA reported **81,329,467 email addresses** after removing overlap between categories. Some had associated attributes or text. These are addresses, not people; the maximum approximately 380 client companies includes both cloud environments. [2](#source-2) - [SEGA](https://www.sega.co.jp/) disclosed 2,196,044 newsletter email-address records, including 92,273 with delivery information. This downstream subset must not be added to ARARA’s total. [1](#source-1) - SEGA and [SEGA Fave](https://www.segafave.co.jp/) newsletters were affected. SEGA excluded names, passwords, card information and SEGA Account emails, and had not confirmed misuse. [1](#source-1) ## Timeline ### October 29, 2026 — Initial disclosure ARARA issued its first notice. [2](#source-2) ### October 31, 2026 — Message service suspended The company disabled environment B credentials and stopped the service. [2](#source-2) ### November 6, 2026 — Revised total published The third report reconciled overlapping address counts. [2](#source-2) ### November 9, 2026 — SEGA reports newsletter impact SEGA published its [customer notice](https://www.sega.co.jp/release/261109_1.html). [1](#source-1) ### November 10, 2026 — Briefing updated This briefing was last reviewed and updated on November 10, 2026. ## Threat Group & Attack Vector Environment B was entered using unauthorized credentials. ARARA corrected October 27 activity to suspected reconnaissance, with login and extraction beginning October 28. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): credentials enabled access to environment B. [2](#source-2) ## Response ARARA’s [response statement](https://www.arara.com/news/info/20261106_arara) acknowledged suspicious emails sent through its service, regulator and police reporting, and an external investigation. Restart depended on remediation, safety checks and credential resets. [3](#source-3) SEGA paused affected newsletters and planned notices and joint regulator reporting. It explicitly distinguished the separate SEGA Fave arcade-server compromise. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### SEGA notice of personal information leakage following unauthorized access to contractor official · SEGA · Nov 9, 2026 ### ARARA Message information leak and service suspension: third report official · ARARA · Nov 6, 2026 ### ARARA Message unauthorized access: apology and future response official · ARARA · Nov 6, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** ARARA Message email-data breach: SEGA paused ARARA-based newsletters, planned joint regulator reporting and individual notices after confirming details, and distinguished its separate SEGA Fave arcade-server incident. 2. **Processor For · 100% confidence · current** ARARA: SEGA 3. **Occurred At · 100% confidence · current** ARARA first discloses unauthorized access: 2026-10-29 4. **Resulted In · 100% confidence · current** ARARA Message email-data breach: The service remained suspended after October 31, with restart dependent on identifying entry paths, replacing credentials and verifying safety; financial impact was still being assessed. 5. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA revised the combined total to 81,329,467 email addresses; some also had attributes or text. The maximum approximately 380 client companies includes the 61 shared-environment clients and environment B. 6. **Disclosed At · 100% confidence · current** ARARA Message email-data breach: 2026-10-29 7. **Occurred At · 100% confidence · current** SEGA discloses newsletter-data impact: 2026-11-09 8. **Affected Organization · 100% confidence · current** ARARA Message email-data breach: ARARA 9. **Affected Organization · 100% confidence · current** ARARA Message email-data breach: SEGA Fave 10. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA acknowledged misuse of its service to send suspicious email, reported to police and regulators, and engaged external specialists to determine entry paths and impact. 11. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA publishes revised deduplicated total 12. **Resulted In · 100% confidence · current** ARARA Message email-data breach: SEGA excluded names, birth dates, gender, addresses, phone numbers, card details and login passwords from this leak; SEGA Account emails used a different system. It had not confirmed misuse. 13. **Occurred At · 100% confidence · current** ARARA Message suspended: 2026-10-31 14. **Began At · 100% confidence · current** ARARA Message email-data breach: 2026-10-28 15. **Exposed Record Count · 100% confidence · current** ARARA Message email-data breach: 81,329,467 record 16. **Used Attack Technique · 100% confidence · current** ARARA Message email-data breach: https://attack.mitre.org/techniques/T1078/ 17. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA confirmed data theft across two cloud environments in one October 28–31 intrusion sequence; the environment B finding was not a new attack. 18. **Ended At · 100% confidence · current** ARARA Message email-data breach: 2026-10-31 19. **Resulted In · 100% confidence · current** ARARA Message email-data breach: An unauthorized party used credentials to access environment B and take email addresses. ARARA disabled those credentials and stopped that environment on October 31. 20. **Affected Organization · 100% confidence · current** ARARA Message email-data breach: SEGA 21. **Occurred At · 100% confidence · current** ARARA publishes revised deduplicated total: 2026-11-06 22. **Resulted In · 100% confidence · current** ARARA Message email-data breach: SEGA reported 2,196,044 exposed newsletter email-address records, including 92,273 with accompanying delivery information. These are a downstream subset, not an additional provider-wide total. 23. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA Message suspended 24. **Resulted In · 100% confidence · current** ARARA Message email-data breach: SEGA discloses newsletter-data impact 25. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA first discloses unauthorized access 26. **Resulted In · 100% confidence · current** ARARA Message email-data breach: ARARA corrected an earlier reference to October 27–28: suspected reconnaissance occurred on October 27, with unauthorized login and extraction on October 28.