SEGA (via newsletter provider ARARA)

How they got in, as reported. A supplier or vendor that was compromised first.

← All cases
Date
9 Nov 2026
Place
France
Who
SEGA (via newsletter provider ARARA)
The way in
Vendor compromise
Source
BleepingComputer
01 · What was reported

What was reported.

SEGA disclosed that a breach at its third-party newsletter provider ARARA exposed the email addresses of 2.2 million newsletter subscribers. Only email addresses were reported exposed.

The way in the source reports: a supplier or vendor that was compromised first.

Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers.BleepingComputer, added to these pages on 10 Nov 2026. The source
02 · The way in

What a vendor compromise is.

A vendor compromise starts at a supplier. An attacker gets into a provider first and reaches its customers through the access or the trust the provider already has.

A message from a real supplier's real mailbox asking to change bank details is the common form. Software updated by a provider the attacker controls is another.

We read a supplier's own public mail records: whether forged mail in its name would be refused and whether look-alikes of its name are registered.

A reading of public records cannot see inside the supplier's systems. A changed bank detail is confirmed by a call to a number already on file, never by a reply.

This part is true of every case of this kind. It says nothing more about SEGA (via newsletter provider ARARA) than the source does.

03 · What we check for it

What we check for it.

The outside services your domain depends on.

04 · If this happens at your firm

If this happens at your firm.

  • Confirm every change of bank details on a number you already hold, even inside a real email thread.
  • Agree with your main suppliers how a change of bank details is confirmed and keep it in writing.
The attacks of 2026 and the habit that stops each →
For technology companies

What we read for technology companies.

  • The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
  • Breach records for addresses at your own domain, read externally; nothing inside is touched.
  • Web addresses an attacker could register to look like yours, each checked: is it registered, is it set up for mail.
  • The certificate your website answers with, seen externally: its name, its dates and who issued it.
  • The headers and cookies your website sends to every visitor, seen externally.
  • Read with the assessment. What AI assistants answer about your business. Assistants build their answers from pages they crawl. A look-alike address an attacker could register can be built to be crawled: its robots file invites the AI crawlers in and its page claims your name. When a client asks an assistant for your phone number, they can get the copy's. In 2025, asked for the sign-in pages of 50 brands, an AI assistant gave addresses the brand did not control one time in three. The check is built to ask six assistants: Claude, ChatGPT search, Gemini, Perplexity, Grok and Copilot, through Bing. Monitoring asks again every week and tells you when a copy's phone or address is in an answer. Source: Netcraft research, read on 4 November 2026.

The rule, from its source: What does each US state's data breach law ask a business to do?

Check my firm

See your own firm the way an attacker reads it.

We read your domain from public records and show each way in with a check anyone can re-run.

Check my firm
05 · Source

Source.

Source: BleepingComputer ↗

This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.