# Maru-Jan online mahjong leaks email addresses and passwords of all 1.86 million members · pwn.watch > Signal Talk, which runs the Japanese online mahjong service Maru-Jan, said on Nov 7 2026 that an attacker abused a feature of its management system and, by about 15:00 JST on Nov 4, downloaded member data including the passwords of all 1,855,578 members and their email addresses where registered. Signal Talk does not hold credit card numbers, so none were included. It says it has identified the intrusion route and fixed the abused part, and it reopened the service at 16:00 JST on Nov 7. It has not said how the passwords were stored. Old passwords still work, so Signal Talk asks every member to change their Maru-Jan password and any matching password used on other services. Page: https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026 · generated 2026-11-08T20:22:39.494Z ## Status - Severity: high · status: live · patch: partial - Product: Maru-Jan member accounts (Signal Talk) - Started: 2026-11-04 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026.json - This file: https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: Signal Talk discloses the leak, says it has identified the intrusion route and fixed the abused part, and reopens Maru-Jan at 16:00 JST after emergency maintenance. It asks all members to change their Maru-Jan password and any reused passwords elsewhere. (https://www.signaltalk.com/press/20261107.php) - 2026-11-04: By about 15:00 JST, an attacker abusing a feature of Signal Talk's Maru-Jan management system has downloaded member data, including the email addresses and passwords of all 1,855,578 members. (https://www.signaltalk.com/press/20261107.php) ## Fix brief # Security brief: Maru-Jan online mahjong leaks email addresses and passwords of all 1.86 million members Source: https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026 · status: live · severity: high · updated Nov 8, 2026, 19:12 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Signal Talk, which runs the Japanese online mahjong service Maru-Jan, said on Nov 7 2026 that an attacker abused a feature of its management system and, by about 15:00 JST on Nov 4, downloaded member data including the passwords of all 1,855,578 members and their email addresses where registered. Signal Talk does not hold credit card numbers, so none were included. It says it has identified the intrusion route and fixed the abused part, and it reopened the service at 16:00 JST on Nov 7. It has not said how the passwords were stored. Old passwords still work, so Signal Talk asks every member to change their Maru-Jan password and any matching password used on other services. Severity detail: Passwords of all 1,855,578 members plus registered email addresses taken; storage format not disclosed; old passwords still valid until changed - Product: Maru-Jan member accounts (Signal Talk) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Change your Maru-Jan password from the official site, and change it anywhere else you reused it. Watch for phishing emails pretending to be Maru-Jan and don't follow password-change links in them. ## Latest updates - Nov 7, 2026: Signal Talk discloses the leak, says it has identified the intrusion route and fixed the abused part, and reopens Maru-Jan at 16:00 JST after emergency maintenance. It asks all members to change their Maru-Jan password and any reused passwords elsewhere. - Nov 4, 2026: By about 15:00 JST, an attacker abusing a feature of Signal Talk's Maru-Jan management system has downloaded member data, including the email addresses and passwords of all 1,855,578 members. ## Advisories - [オンライン麻雀「Maru-Jan」への不正アクセスによる会員情報流出のお詫びとご報告](https://www.signaltalk.com/press/20261107.php) (Signal Talk Inc.) - [会員情報流出についてのお詫びとご説明](https://www.maru-jan.com/2026information.html) (Maru-Jan) ## Write-ups & news - [シグナルトークのMaru-Janで会員185万5,578人分のパスワードが流出](https://cybersecurity-jp.com/news/118198) ## Caveats Signal Talk has not said when the intrusion began or which management-system feature was abused. It is offering each member 3,000 points as an apology, claimable until Nov 20. --- Machine-readable: https://pwn.watch/i/maru-jan-online-mahjong-1-86m-passwords-leak-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.