SEGA lost 2.2 million email addresses without being hacked. The company that sends its newsletters was

Nobody broke into SEGA. On 9 November the games company said that 2,196,044 email addresses belonging to its newsletter subscribers had leaked anyway, because the firm it pays to send those newsletters was breached. That firm is Arara, a Japanese mailing service, and SEGA is one of roughly 380 client companies caught up in it.

The sequence is the instructive bit. Between 28 and 30 October, somebody used Arara's own system to send up to 7.13 million emails posing as credit card companies and asking people to check their statements, all from a genuine Arara address. On 29 October SEGA asked Arara whether its data was safe and was told there had been no leak. On 2 November Arara's parent company, Paycloud, said about 77 million email addresses may have been exposed. A day later SEGA got the email confirming its own were among them. BleepingComputer lists MOS Burger (7.5 million addresses), the Shochiku cinema chain, TKC and the mobile provider IIJmio as other victims.

For SEGA subscribers the damage is limited. The company says no names, home addresses, phone numbers, card details or passwords were in the data, that addresses tied to a SEGA Account sit on a separate system, and that it has seen no misuse so far. The lists that leaked were for eleven mailings sent between July and October, mostly about arcade games and its online prize lottery. It will contact the people affected individually.

An email address alone doesn't sound like much, but a list of confirmed SEGA fans is exactly what a phisher wants. SEGA says it will never ask for a password or card number by email, so anything that does, under its name or Arara's, belongs in the bin. Tendvane's Privacy & accounts check is a quick way to see how well the email account behind all those newsletters is protected.