Threat watch / Breach
Maru-Jan: email addresses and passwords of 1.85 million players leaked
SignalTalk, the Japanese company behind the online mahjong game Maru-Jan, says attackers abused a function of its management system and downloaded the email addresses and passwords of all 1,855,578 members by November 4. It asks players to change their password there and on any other service where they reuse it.
- Sector
- Consumer apps & devices
- Way in
- Not public yet
- Product or vendor
- None named
- members whose emails and passwords were taken[1]
- 1.86M
- How it happened
- SignalTalk says the access "abused a function of our management system". It says it has identified the entry route and fixed the abused point, but does not describe the method.[1][2] Checked 8 Nov 2026
- What was stolen
- Email addresses (for members who registered one) and passwords. SignalTalk does not say whether passwords were stored in plain text or hashed. It says it holds no card numbers, so none were taken.[1][2] Checked 8 Nov 2026
- Who was impacted
- All Maru-Jan members: 1,855,578 people, according to SignalTalk.[1] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Member data is downloaded from outside by about 15:00 Japan time, according to SignalTalk. [1][2]
- Maru-Jan announces emergency maintenance after a cyberattack. [4]
- SignalTalk publishes its apology and report, resumes the service at 16:00 Japan time, asks members to change reused passwords, warns of phishing emails imitating Maru-Jan and offers 3,000 points per member. [1][2]