SEGA's 2.2M email leak traces to newsletter vendor Arara

SEGA didn't get hacked. Its newsletter vendor did. On November 9, SEGA confirmed that 2,196,044 customer email addresses leaked in the Arara Message breach, an attack on the Japanese email delivery service SEGA used for some of its newsletters. Arara says the attackers took about 77 million addresses across its clients. If your email tool holds your customer list, this is your risk too.

What actually happened

SEGA's notice covers newsletters for SEGA and its arcade subsidiary SEGA FAVE, sent between July 2 and October 28.

• What leaked. 2,196,044 email addresses. 92,273 also carried "information associated with delivery," which SEGA and Arara are still identifying. No names, birth dates, addresses, phone numbers, card data or passwords.
• What didn't. SEGA Account emails. They go through a different sending system.
• The timeline. SEGA asked Arara on October 29 whether its mailings were safe. Arara said it had found no leak. After Arara went public on November 1, SEGA asked again. On November 3, Arara confirmed SEGA's addresses had left the building.

Arara's own numbers are bigger, per Impress Watch. It found the intrusion October 28 and suspended service October 31. About 77 million addresses were taken, possibly with duplicates. For 61 clients, 3,386,187 records also held profile data such as names, birth dates, phone numbers and addresses. The attackers also used Arara's servers to send up to 7.13 million phishing emails from news@arara.com.

Same week, different country: Who Gives A Crap told customers that a US marketing software provider exposed names, emails, phone numbers, mailing addresses and lifetime spend, ABC News reported.

Why it matters for your business

Your email platform is a copy of your customer database, with a send button. Most stores sync far more to it than a newsletter needs.

1. Inventory it. List every marketing tool that holds customer data and which fields it gets.
2. Sync less. If a campaign doesn't use birth date or lifetime spend, don't send it.
3. Purge. Delete unsubscribed and long-dead contacts. A record you don't hold can't leak.
4. Don't take the first "no." SEGA's vendor said no leak, then confirmed one five days later. Put a breach-notice deadline in your contract.
5. Warn customers early. Tell them you'll never ask for passwords or card numbers by email.

Sources: SEGA, Impress Watch, ABC News.