Airline Email Leak Hits Solaseed and AIRDO

Two regional Japanese carriers have disclosed an airline email leak after unauthorised access to an external mail-delivery system they each use. Solaseed Air says about 490,000 customer email addresses were taken. AIRDO puts its exposed address count at a maximum of 673,920. Neither notice names the vendor.

Japanese press, including Yomiuri and Nikkei, attributes both incidents to Arara Message, the mail service already covered on TSN after Arara said about 77 million addresses across up to roughly 380 client companies were at risk. That press link is reported only. The airlines have not confirmed Arara as their provider in the notices TSN has read.

In brief

Solaseed Air reports about 490,000 email addresses leaked; AIRDO reports a maximum of 673,920.
Both point to unauthorised access on an external mail-delivery system; neither names the vendor.
Japanese press attributes the cases to Arara Message; that link is reported, not airline-confirmed.

What each airline says was taken

Solaseed Air’s notice, updated on 5 November, says a third party downloaded files from the external mail system and that some of those files held personal data. By 4 November the carrier had confirmed that the leaked items were email addresses only. Names, addresses, phone numbers and card details were not among the confirmed exposures. Solaseed says it has reported the matter to Japan’s Personal Information Protection Commission and will contact affected customers once contact arrangements are ready.

AIRDO’s 4 November notice is narrower on fields and broader on operational impact. It says email addresses that travelled through the external mail-delivery system were leaked, with a stated maximum of 673,920. It does not claim other identity fields were taken. To limit further harm, AIRDO has cut off the unauthorised access path and stopped the affected mail services, including reservation and ops messages and My AIRDO-related mail. It tells customers to treat unexpected messages with care and to check bookings and flight status on the official site rather than by clicking links in mail.

Solaseed’s timeline shows how long a vendor-side incident can take to resolve into a customer figure. The carrier says it first heard on 28 October that some of the contractor’s mail servers had been breached, paused mail as a precaution, was briefly told on 30 October that it was unaffected, then stopped reservation and boarding mail again on 31 October after the known server scope widened. On 2 November it was told customer addresses may have been taken; on 4 November it pinned the count at about 490,000.

Why an address-only airline email leak still matters

Email addresses alone are enough to run convincing phishing against travellers who expect booking changes, delay alerts and boarding passes in their inbox. That is why both carriers stress vigilance even while saying richer identity and payment data were not confirmed in these disclosures. An airline-branded fake refund or rebooking message is a classic follow-on, and the same pattern appears after other large Japanese consumer breaches, from Club Tourism’s member-record case to earlier mail-vendor incidents on TSN’s ransomware and cyber attacks hub.

The Arara Message story already on TSN shows the scale a shared mail platform can reach when many client companies sit on one stack: Arara’s second report put about 77 million addresses in scope and stopped the service on 31 October. Press now placing Solaseed and AIRDO in that cluster is therefore newsworthy, but it is still press attribution. Until an airline or Arara names the commercial link in an official channel, TSN will not treat either carrier as a confirmed Arara client. Readers should also keep this mail-vendor path separate from the earlier Amadeus booking-data incident that affected several Japanese airlines through a different system; AIRDO itself has previously discussed Amadeus in a separate notice, and the two matters are not the same leak.

For passengers the practical steps are ordinary and urgent: ignore unexpected airline mail, open the carrier site or app directly, and treat any request for card details or password resets with suspicion. For operators and UK or EU firms that buy the same class of bulk mail tools, the lesson is concentration risk. When reservation, delay and loyalty mail all ride one contractor, a single intrusion becomes a multi-brand phishing surface overnight. Watch for named-vendor confirmations, restored mail schedules, and whether Arara or the airlines expand the field list beyond addresses.