SEGA Arcade Outage Leaves Japan's Arcades Dark for a Week

SEGA Arcade Outage Leaves Japan's Arcades Dark for a Week

Japan's arcades went quiet on November 1. SEGA Fave, the SEGA group company that runs the ALL.Net arcade network and the Aime player card service, suspended services at 3 p.m. Japan time after discovering unauthorized access to some of its servers. A week later, some games are only now coming back, and SEGA's own titles are still down with no restart date.

The SEGA arcade outage is not a data breach story, at least not yet. It is an availability story, and a reminder that the online services behind physical machines can take the machines down with them. When ALL.Net goes dark, the cabinets that depend on it lose online matches, leaderboards, save data, and card features. Some lose the ability to run at all.

What went down

The suspended services include online gameplay for ALL.Net-supported titles, arcade location information on official websites, and associated .NET services. Gameplay using Aime and PrizeON, the SEGA Lucky Kuji Online service, and new SEGA ID registrations were also suspended. SEGA Fave confirmed the intrusion in a notice on November 2, and said completing the investigation would take additional time.

The disruption extends beyond SEGA's own games. Bandai Namco Experience confirmed that the incident affects eight of its ALL.Net-supported titles, including Taiko no Tatsujin, Mario Kart Arcade GP DX, The Idolmaster TOURS, JoJo's Bizarre Adventure: Last Survivor, and Wangan Midnight Maximum Tune 6RR PLUS. For Mario Kart Arcade GP DX, an official notice warned that cabinets would progressively become unavailable from November 3 onward, and that offline operation would also be unavailable.

SEGA said its initial investigation found no evidence that information relating to customers or business partners had been exfiltrated. That is a preliminary finding, not a final one: the company is still assessing the incident, and the absence of identified theft does not establish that nothing was taken. Payment information, including credit card details, was not stored on the compromised servers, so those records were unaffected. The announcement does not identify the intruder, explain how access was gained, or say when the intrusion began. It does not characterize the incident as ransomware.

What is coming back

On November 8, some functions were restored as of 9 a.m., and Bandai Namco titles began gradually resuming trial operations the same day. Bandai Namco Experience published a notice about the trial resumption, and its ALL.Net-compatible titles are reportedly limited to a maximum of 72 hours of offline operation.

SEGA's own products are a different story. As of 9 a.m. on November 8, various ALL.Net and Aime services for SEGA titles remained under maintenance, online services were unavailable, and there was no estimated time for service resumption. The next update is scheduled for around 9 a.m. on November 10. Online play via Aime remains unavailable for titles such as CHUNITHM and maimai deluxe.

This is the second time the service has gone down in about a month. SEGA took the same service down for multiple days at the end of October to address a PHP exploit, then reopened it by limiting access to Aime and ALL.Net services only to Japan, which drew complaints from international fans. Now the games are offline again, with no clear date for their return.

The bigger picture in Japan

The SEGA incident landed in the middle of the worst breach wave Japan has seen. The same week, the government compiled an emergency countermeasures package on November 6, and the National Police Agency opened a nationwide joint investigation into the year's large breaches. The Arara Message email delivery breach passed 81 million email addresses. MUJI reported up to 27.26 million records, Nojima about 7 million, and the beauty site @cosme about 3 million. SMBC Consumer Finance disclosed data on up to 320,118 borrowers.

Against that backdrop, the SEGA outage looks small in terms of records exposed, and large in terms of visible disruption. A breach that steals email addresses is abstract. An arcade network going dark is something thousands of people notice the same evening. The two kinds of incident need different responses: one needs credit monitoring and password changes, the other needs a service restoration plan and honest communication about when the machines come back.

What players should do

If you play an affected title, check the official status page for that game before heading to an arcade, and do not assume a cabinet will work offline. Aime card balances and save data live on SEGA's side, so there is nothing to back up locally. If SEGA later confirms data was taken, the usual steps apply: watch for phishing messages pretending to be SEGA support, and change the password on your SEGA ID. The BAE Systems breach showed how a single intrusion can cascade into other systems, and the Burger King Japan breach showed how fast a Japanese consumer breach can scale. For now, the SEGA story is about patience: the investigation is open, the network is partly back, and the next update lands November 10.