2026 Solaseed Air — about 490,000 emails via third-party mailer (Arara); names/cards not leaked
Data compromised
About 490,000 email addresses — destinations of mail sent from [email protected] between 1 July and 31 October 2026. Solaseed says names, addresses, phone numbers and payment-card data were not leaked.
Technical writeup
Official Solaseed notice updated 6 Nov 2026. Vendor named Arara by Nikkei/Yomiuri. Same-week ARARA Message platform incident. Count is emails.
Root cause
Unauthorised access to the external email-delivery system. Vendor reported the incident 28 October 2026; Solaseed confirmed a customer-email take on 4 November after an earlier all-clear on 30 October. Nikkei names Arara. PPC notified 4 November. Mail stopped 31 October.