November 4, 2026: Solaseed Air said about 490,000 email addresses leaked from the external mailer it uses for reservations. The set is destinations of mail from [email protected] between 1 July and 31 October 2026. Names, addresses, phones and cards were not leaked, the airline says. The catalog entry records that email count.
What is known
- The vendor reported unauthorised access on 28 October. Solaseed paused mail as a precaution, was told on 30 October that it was not affected, then on 31 October stopped all reservation and boarding mail after the vendor widened the incident. On 2 November the vendor said customer emails may have left; on 4 November Solaseed fixed the count and reported to Japan's Personal Information Protection Commission.
- Nikkei and Yomiuri named Arara as the vendor. Solaseed's page says "external email system." See the ARARA Message platform row for the 81.3 million unique-email census — do not add 490,000 on top of it.
- Boarding-pass mail is down. The airline tells passengers to keep reservation and ticket numbers and to print or save a pass from the website.
What is not known
- How many unique people sit behind 490,000 send events.
- Whether later investigation adds fields beyond email.
- When mail will resume. Solaseed has not given a date.
An earlier "no leak" report on 30 October was withdrawn. Use the 4 November census, not the all-clear.
Who is at risk
Passengers who received reservation or operations mail from [email protected] in July–October 2026. Smile Club members waiting on membership mail are in the outage even if their address is later excluded from the leaked set.
What to do
- Confirm flights on Solaseed Air's website. Do not follow a "delayed boarding QR" in unexpected mail.
- Write down reservation and ticket numbers from the booking screen.
- Complete online check-in on the site and save or print the pass; mail delivery of the barcode is stopped.
- Ignore password or refund mail that claims to be from Solaseed until the company says the mailer is back.
- If you also flew AIRDO, that carrier published a separate emails-only notice the same week.
Sources
- Solaseed Air, updated November 6, 2026
- Nikkei, November 4, 2026
- ARARA / Paycloud Holdings, November 6, 2026
Sourcing note: 490,000, the July–October window and the emails-only finding are Solaseed's. The Arara name is from Japanese press.