SEGA has confirmed a data leak exposing the email addresses of 2.2 million newsletter recipients, Anime News Network reported Monday. The company says there are no indications that any other personal information was compromised in the incident.

Email-only leaks sit at the milder end of the breach spectrum — no passwords or payment data appear to be involved — but they are not harmless. Leaked address lists routinely fuel phishing campaigns, and a verified list of SEGA newsletter subscribers hands scammers a ready-made audience for fake promotions, bogus account alerts, and counterfeit game offers dressed in the company's branding.

The practical advice for anyone on SEGA's mailing lists: treat unexpected SEGA-branded emails with extra suspicion in the coming weeks, especially anything requesting login credentials or payment details, and remember that legitimate companies don't ask for passwords by email. Per the ANN report, SEGA has not indicated how the leak occurred or whether affected subscribers will be notified individually — details that will determine how seriously the incident reflects on the company's data handling once the fuller picture emerges.