A breach at SEGA's email provider exposed 2.2 million newsletter addresses. The bigger risk is fake credit card emails, so it pays to know what to watch for.
SEGA says the email addresses of 2.2 million newsletter subscribers were exposed. The leak did not come from SEGA's own systems. It came from ARARA, a company SEGA hired to send its newsletters. The same breach hit many other companies, and attackers used ARARA's service to send fake emails posing as credit card companies.
ARARA disclosed on November 2 that its email distribution service was breached. It says 77 million email addresses from nearly 380 corporate clients were compromised. ARARA points to a web server weakness and problems in its system environment. How the attackers got in, and when, is still under investigation.
The timeline is worth noting. ARARA first estimated a smaller impact. On October 29, it told SEGA no data had been compromised. On November 3, after finding the full scope, it told SEGA data had been exposed. It shared full details between November 5 and 8.
SEGA says the exposed data did not include names, dates of birth, gender, home addresses, phone numbers, credit card details or account passwords. It also says addresses registered to a SEGA Account run on a separate system and were not affected. SEGA reports no confirmed evidence of misuse so far.
Even so, an email address alone is useful to scammers. It tells them your address is real and that you signed up for something. Other companies were hit too: MOS Burger (7.5 million addresses), Shochiku Multiplex Theatres (3.3 million records), TKC (2.3 million) and IIJmio (nearly 1 million).
ARARA says attackers abused their access to send more than 7 million emails in late October that impersonated credit card companies. These are phishing emails, meaning messages built to trick you into giving up card numbers or passwords. If you have ever signed up for a newsletter, expect more of them, and expect some to look convincing.
The steps in the alert box above explain how to handle any email that mentions your cards.
This is not SEGA's only recent problem. On November 2, SEGA FAVE, the unit that runs toys, gadgets and arcade machines, reported unauthorized access to servers behind its ALL.Net and Aime arcade network services. Those services are still offline for maintenance and safety checks. Its first review found no sign that customer or partner data was taken, and payment information was stored separately. SEGA says the two incidents are unrelated.
ARARA and SEGA are still working out exactly what data was exposed. The method and timing of the intrusion are not yet known. More companies could come forward as ARARA's clients finish their own checks.
Do not trust any email about your credit card, and open your card company's app or website yourself instead of clicking a link.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersN-able switched off its hosted IT management service after a researcher posted attack code for more than 30 alleged flaws. Businesses that rely on IT providers should pay attention.
Read more: N-able shuts down IT management service after flaws posted onlineA hacker stole data from forms on 14 York University websites, going back to 2007. Contact details and student ID numbers could fuel convincing scam messages.
Read more: York University says hackers stole data from website forms back to 2007
