Maru-Jan online mahjong leaks email addresses and passwords of all 1.86 million members
Maru-Jan member accounts (Signal Talk)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Signal Talk, which runs the Japanese online mahjong service Maru-Jan, said on Nov 7 2026 that an attacker abused a feature of its management system and, by about 15:00 JST on Nov 4, downloaded member data including the passwords of all 1,855,578 members and their email addresses where registered. Signal Talk does not hold credit card numbers, so none were included. It says it has identified the intrusion route and fixed the abused part, and it reopened the service at 16:00 JST on Nov 7. It has not said how the passwords were stored. Old passwords still work, so Signal Talk asks every member to change their Maru-Jan password and any matching password used on other services.
Why this severity: Passwords of all 1,855,578 members plus registered email addresses taken; storage format not disclosed; old passwords still valid until changed
- Started
- Nov 4, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline2
Signal Talk discloses the leak, says it has identified the intrusion route and fixed the abused part, and reopens Maru-Jan at 16:00 JST after emergency maintenance. It asks all members to change their Maru-Jan password and any reused passwords elsewhere.
By about 15:00 JST, an attacker abusing a feature of Signal Talk's Maru-Jan management system has downloaded member data, including the email addresses and passwords of all 1,855,578 members.
Advisories2
News & write-ups1
Notes & caveats
Signal Talk has not said when the intrusion began or which management-system feature was abused. It is offering each member 3,000 points as an apology, claimable until Nov 20.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
