Overview
The figure counts email addresses, not people. A maximum of approximately 380 contracting companies remains under review. Other membership fields vary by customer company. The shared-environment subtotal was corrected to 2,842,400; overlapping categories must not be summed again. A maximum of approximately 7.13 million fraudulent emails sent is a different metric. Do not add this root-event scope to SEGA-specific impacts.
Timeline
- Occurred
- Discovered
- Disclosed
Initial public notice and initial authority reports.
All services were suspended.
Third report and corrected, deduplicated scope published.
Organization response
All platform services were suspended on October 31. Arara engaged specialists, contacted customers and notified police and data-protection authorities. Restart depends on safety checks and resetting customer authentication.
What you can do
Be alert to impersonation messages. If card details were entered in a fraudulent site, contact the card issuer.
Sources
- 「アララメッセージ」への不正アクセスに関するお詫びと今後の対応についてアララ株式会社 · 2026-11-09
- アララメッセージへの不正アクセスに関するお知らせアララ株式会社 · 2026-11-09