AIRDO and Solaseed Air Email-Vendor Breach: What to Do Now

Two Japanese airlines have lost the email system they use to talk to passengers. AIRDO (エア・ドゥ) and Solaseed Air (ソラシドエア) both send booking confirmations, check-in barcodes and flight-status mail through an outside email delivery service. Attackers broke into that service in late October 2026, took customer email addresses, and the airlines have had to stop sending that mail.

The numbers come from the airlines themselves. AIRDO says up to 673,920 email addresses leaked. Solaseed Air says about 490,000 email addresses leaked, and that names, addresses, phone numbers and credit card details did not. Neither airline names the vendor. Nikkei, Yomiuri and other Japanese outlets identify it as アララ (Arara Inc.), a Tokyo company whose email delivery service is called アララメッセージ (Arara Message).

Solaseed Air's notice explains why this matters for anyone who manages suppliers. On 30 October the vendor told the airline that none of its data had leaked. Three days later, on 2 November, it said the airline's customer email addresses may have been taken.

No CVE has been assigned. This is a supply-chain incident at a hosted email provider, so there is no CVSS score or KEV listing.

Technical Information

What the vendor has disclosed

Arara's parent company, ペイクラウドホールディングス (PayCloud Holdings, Tokyo Stock Exchange Growth 4015), has published two reports. The first, on 29 October, described one breached system, about 3.01 million email addresses taken, and a web server vulnerability as the cause.

The second report, on 2 November, is much larger. PayCloud says:

• The attacker also got into 97 servers used by Arara's business customers, beyond the shared environment named in the first report. PayCloud estimates up to about 380 customer companies are affected.
• About 77 million email addresses were taken or may have been taken. PayCloud is still checking that figure and says it is not a count of people, since one person can have several addresses.
• From those 97 servers, the data also included whatever each customer company had stored, such as name, gender, date of birth, phone number, member number and address. The fields differ from one customer to the next. Arara says it holds no credit card numbers.
• In the shared environment, the attacker logged in to the admin panel and used its data export functions. PayCloud revised that count to 3,386,187 addresses across 61 customer companies, plus up to 411,827 records with names and company names from five of them.
• The attacker also used the service to send up to about 7.13 million phishing emails posing as credit card companies, from 28 to 30 October.
• The cause is now described as the web server vulnerability plus problems in the system environment. PayCloud has not named the vulnerability. It says it is still investigating how and when the attacker first got in. PayCloud says all of its counts are still being checked and may change, and that it will publish the results in a third report.
• Arara stopped the whole service on 31 October. It has not said when it will restart. Before restarting, it plans to ask customer companies to reset admin passwords and API keys.

Other Japanese companies have since published their own notices tied to Arara, according to Nikkei. AIRDO and Solaseed Air are sister airlines under the same holding company, according to Sankei.

Timeline

Times below are as PayCloud published them. Its report does not state a time zone; we read them as Japan time. Solaseed Air's entries (dates only) come from its notice and PayCloud's from its 2 November report.

AIRDO published its own notice on 4 November. It gives no dates for when it was told.

Read the two columns together. By the timeline table in PayCloud's report, data was leaving customer-company servers from early on 29 October until 02:22 on 30 October. The report's main text describes the intrusion into those servers more broadly as running from 28 to 31 October. Solaseed Air got its all-clear on 30 October. The vendor says it only found that exfiltration the next morning. The all-clear matched what the vendor knew at the time, not what had happened. Neither airline has said which Arara environment held its data.

Why the email shutdown raises the phishing risk

AIRDO has stopped booking, purchase, change and refund mail, online check-in barcode mail, and flight-status mail including delays and cancellations. It has also stopped rebooking notices and My AIRDO account mail, and its inquiry forms are not working properly. It warns that some delayed mail may arrive much later than scheduled once sending resumes. Nikkei reports that Solaseed Air has not emailed tickets since 31 October and has no date for restarting.

That leaves a gap attackers can use. They hold a list of addresses tied to a known airline, and passengers are waiting for mail that isn't coming. A fake "your flight has changed" or "confirm your booking" message fits that gap neatly. Genuine but very late mail will make the fakes harder to tell apart. AIRDO and Arara are telling recipients not to click links in unexpected mail, and Yomiuri reports that Solaseed Air has warned customers about mail pretending to be from the airline.

Secondary context: Air Creebec (Canada, separate incident)

On 4 November, Canadian regional airline Air Creebec announced an intrusion into some of its administrative systems. It says administrative files were taken. They may include personal information, mainly about current and former employees, as well as passengers. Other files may hold operational, administrative or financial information about customers and partners. It says flight safety and operations were not affected, because flight systems run separately. It has not published a count or named any third party. There is no known link to Arara. We include it only because its customers and partners are now being told to watch for the same kind of follow-up phishing.

Affected Product Versions

• Product: アララメッセージ (Arara Message), a hosted email delivery service run by Arara Inc. It has no customer-installed versions.
• Affected environments (per PayCloud): the shared environment named in the 29 October report, and 97 servers used by customer companies. Arara is notifying each customer company individually about whether its environment was affected.
• Status: the service has been fully stopped since 31 October 2026, with no restart date.
• Arara's other services: PayCloud says they were not affected.
• Air Creebec: affected systems are described only as "administrative systems". No product or version has been named.

Workaround and Mitigation

If your company uses Arara Message, or did until 31 October:

1. Don't wait for the vendor's notice. Ask Arara directly whether your environment was in the shared environment, among the 97 servers, or both, and which data fields were taken.
2. List every field you stored in the service, not just email addresses. On the 97 servers, the data taken included whatever each customer had stored there.
3. Before the service restarts, change your admin passwords and API keys, as Arara plans to ask customer companies to do. Also search your own code, configuration files and scripts for old Arara keys.
4. Check who has admin-panel access. PayCloud says it is still working out whether customer staff names and email addresses were exposed.
5. Prepare the notice you may need to send customers, and check what you must report to the PPC.

If you run customer mail through any outside email provider:

1. Have a backup way to send. Decide in advance how you will send booking, delay and security mail if the provider goes down. Options include another provider, your own mail server, website banners, SMS or the app.
2. Lock down your sending domain. Enforce DMARC so mail spoofing your domain is rejected rather than just reported. Check exactly which provider servers are allowed to send as your domain.
3. Tell customers what you will never ask for, both on your website and in your app, before attackers start writing to them.
4. Keep only what the provider needs. Don't store date of birth, address or member numbers in a mailing tool unless you have to.

For passengers and recipients: follow the airlines' advice. Get booking details, check-in and flight status from the official website or app, not from links in email. Treat unexpected payment or "confirm your details" messages as suspicious.

Indicators of Compromise

The vendor has published only the markers of its phishing run. No IP addresses, domains, file hashes or vulnerability ID have been released. We have not added any.

PayCloud says the phishing mail went to email addresses the attacker brought in from outside the service. Expect follow-up phishing that names AIRDO, Solaseed Air or other Arara customers, from senders that have nothing to do with Arara.

What to Do With Your Email-Delivery Suppliers Today

Email delivery providers sit quietly between you and your customers. They hold your customer list, they send under your name, and much of your customer service depends on them. This incident shows two risks. When the provider is breached, your customer data goes with it. When it goes down, your customers stop hearing from you just as attackers start writing to them. Japan has already seen this pattern this autumn with the Blastmail newsletter service, a different vendor and a different incident.

The lesson from Solaseed Air's timeline is simple: a vendor saying "you're not affected" is a starting point, not the end of checking. Keep the case open until the vendor's investigation is finished and confirmed in writing.

Questions worth sending to your email delivery and marketing-automation providers this week:

1. Do you use Arara or アララメッセージ, or any subcontractor that does, for mail sent on our behalf?
2. Which of our data fields do you store, and in which environment: shared or dedicated to us?
3. When you tell us we are "not affected", what checks is that based on, and will you confirm it in writing once your investigation is finished?
4. How quickly will you tell us if the scope of a breach grows, and who will tell us?
5. Can attackers use your admin panel's export functions or API keys without a second check, such as multi-factor sign-in or IP restrictions?
6. If your service goes down, what help will you give us to keep sending booking and security mail?

Need help working through email-delivery and marketing-automation suppliers exposed to the Arara breach? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• AIRDO, 【重要】メール配信システムへの不正アクセスとメールサービスの停止について (4 Nov 2026): https://www.airdo.jp/news/2026/news-10708.html
• ソラシドエア (Solaseed Air), 【重要】外部メール送信システムへの不正アクセスによる個人情報漏えいに関するお詫び (updated 5 Nov 2026): https://www.solaseedair.jp/info/2026/11/post-20260912.html
• アララ株式会社 (Arara Inc.), 当社が提供する「アララメッセ－ジ」への不正アクセスによる情報流出およびサービス停止について (29 Oct 2026): https://www.arara.com/news/info/20261029_arara
• ペイクラウドホールディングス (PayCloud Holdings), 同（第２報） (2 Nov 2026, TSE disclosure): https://www2.jpx.co.jp/disc/40150/140120261102562067.pdf
• Air Creebec, "Air Creebec confirms cybersecurity intrusion affecting some of its administrative systems" (4 Nov 2026): https://www.newswire.ca/news-releases/air-creebec-confirms-cybersecurity-intrusion-affecting-some-of-its-administrative-systems-880065062.html
• Nikkei, Arara named as AIRDO's vendor (4 Nov 2026): https://www.nikkei.com/article/DGXZQOCC04AZR0U6A101C2000000/
• Nikkei, Solaseed Air ticket mail halted (4 Nov 2026): https://www.nikkei.com/article/DGXZQOJC04AKR0U6A101C2000000/
• Sankei, both airlines (5 Nov 2026): https://www.sankei.com/article/20261105-USRNVO6EGNDS3H3HLI7QUB637E/
• Yomiuri via Yahoo! News Japan, Arara named as Solaseed Air's vendor: https://news.yahoo.co.jp/articles/7b10a9c95f521d60568e5dd57c2c04d6c0e8f7cf