[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPKeUScvFD3d9Jg696ig3eSHnyruVWV91mv43xTtwnPY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"65533adf-7687-4966-b6fa-e304f9cd6733","SEGA newsletter data breach exposes 2.2 million email addresses","sega-newsletter-data-breach-exposes-2-2-million-email-addresses-d6705a","Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]","Japanese gaming giant SEGA has announced a data breach affecting 2.2 million newsletter subscribers due to a compromise at its third-party email provider, ARARA. The breach also exposed additional data for nearly 92,300 records, though sensitive information like names or payment details were not compromised. ARARA reported a separate incident impacting 77 million email addresses from nearly 380 clients, attributing it to a web server vulnerability.","SEGA reports 2.2 million email addresses exposed in third-party newsletter provider data breach.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsega-newsletter-data-breach-exposes-22-million-email-addresses\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F09\u002FSEGA.jpg","2026-11-09T22:09:33+00:00","2026-11-09T23:00:02.924006+00:00",7,[17,20,22],{"name":18,"type":19},"SEGA","vendor",{"name":21,"type":19},"ARARA",{"name":23,"type":24},"SEGA Fave","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,21,23],{"controls":46,"vendors":132},[47,74,103],{"slug":48,"name":49,"problem":50,"products":51},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":69,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":69,"url":72,"description":73},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":75,"name":76,"problem":77,"products":78},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":104,"name":105,"problem":106,"products":107},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"sega-newsletter-breach-third-party-email-provider-exposes-22-million-subscribers","SEGA Newsletter Breach: Third-Party Email Provider Exposes 2.2 Million Subscribers","SEGA's data breach was not caused by a failure within SEGA's own systems, but by a vulnerability in a third-party email service provider, ARARA, whose web server was compromised. This highlights the critical risk of supply chain dependencies — an organization's security posture is only as strong as its weakest vendor. The scale of ARARA's broader incident (77 million addresses across 380 clients) demonstrates how a single vendor vulnerability can cascade across an enormous number of organizations simultaneously. Companies must treat third-party data processors as extensions of their own attack surface and enforce rigorous vendor security standards before entrusting them with customer data.",[138,139,140,141,142,143,144],"CIS Control 15: Service Provider Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","GDPR Article 32","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 32":146,"NIS2 Article 21(2)(b)":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"CIS Control 15: Service Provider Management":149,"OWASP A06:2021 Vulnerable and Outdated Components":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"GDPR Article 32 requires both controllers and processors to implement appropriate technical and organisational measures to secure personal data; ARARA's unpatched web server represents a failure of this obligation, exposing 2.2 million email addresses.","NIS2 explicitly requires covered entities to manage risks arising from supply chain relationships and service providers, directly addressing the scenario where a vendor's vulnerability leads to downstream customer data exposure.","ARARA's exploited web server vulnerability represents a failure of flaw remediation; NIST SI-2 requires organizations — and by extension their vendors — to identify, report, and correct information system flaws promptly.","SEGA relied on a third-party email provider without sufficient oversight; CIS Control 15 mandates establishing and enforcing security requirements for all service providers handling organizational data.","ARARA's breach was attributed to a web server vulnerability, which aligns with OWASP A06, highlighting the danger of running unpatched or outdated server-side components in internet-facing environments.","The breach stemmed from an unpatched web server vulnerability at ARARA; this control requires that technical vulnerabilities be identified and remediated in a timely manner, including within supplier systems.","Proper access controls and authentication on ARARA's web server infrastructure could have limited the attacker's ability to access and exfiltrate bulk subscriber data following initial exploitation."]