For: members of the online mahjong game Maru-Jan (the company says all members). This article is an explanation based on the official notice from Signaltalk Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
members of the online mahjong game Maru-Jan (the company says all members).
- Confirmed so farSee the table ↓
- Unauthorized access and exfiltration
- Email address
- Password
4 more
- Affected group
- Count
- Intrusion route
- Service status
- Not yet confirmed
- How passwords were stored (for example whether hashed)
- The detailed intrusion route
- Whether and how members will be notified individually
1 more
- Progress of the investigation and details of the preventive measures
- What to do nowSee the steps ↓
- Change the password at services where you used the same one as Maru-Jan
- Change your Maru-Jan password
- Do not open links in emails that use the Maru-Jan name
2 more
- Turn on two-step verification where you can
- If you are worried, use the official contact page
- Where to verify (source)All sources ↓
- Signaltalk Co., Ltd., "Apology and explanation regarding the leak of member information" (November 7, 2026, notice on the official Maru-Jan site; in Japanese)
- Last checked
- As of November 9, 2026
Follow-up plans and what we checked
The company says it will report facts found in its continuing investigation and progress on countermeasures on its official site as they arise. When we checked the notice page on the official Maru-Jan site on November 9, 2026, we found nothing beyond the notice dated November 7.
What Maru-Jan members should do today
Change the password at services where you used the same one as Maru-Jan
The company asks you to change it promptly at any other service, such as email or shopping sites, where you used the same password. A leaked email address and password pair can be tried automatically at other services (general point).
Start with your email account: if it is taken over, it can be used to reset passwords elsewhere. Then shopping, finance and social media. To check, see How to check whether your password has leaked.
Change your Maru-Jan password
The company says you can still log in with your current password, but that continuing to use a leaked password risks misuse, and asks you to promptly change it to one you do not use at any other service. You do this from the member page on the official site.
Make the new password long and unique. If that is hard to remember, Choosing a password manager can help.
Do not open links in emails that use the Maru-Jan name
The company says suspicious emails posing as notices from Maru-Jan may arrive at the leaked email addresses. It asks you to do password changes and similar actions by opening the official site you normally use, not through links in emails.
For how to spot them, see What is phishing?.
Turn on two-step verification where you can
At any reused-password service that offers two-step verification, turn it on. Even if the password is known, it can stop a login at the last step (this site's view). See Getting started with multi-factor authentication.
If you are worried, use the official contact page
The contact point in the notice is the "contact us / report a problem" page on the official Maru-Jan site. Open it yourself from the official site, not from a link in an email.
As an apology, the company has prepared 3,000 points (worth 3,000 yen) per member, which can be claimed from the member page until 24:00 on Friday, November 20. Claim them from the official site, not from an email link.
What happened (from the Signaltalk notice)
On November 7, 2026, Signaltalk Co., Ltd. published nearly the same content as a notice on the official Maru-Jan site and as a press release (the count and the restart time appear only in the press release). Everything below is from the company's notice.
November 4, about 15:00
A function of the company's administration system was abused, and data including member information was downloaded externally (the company confirmed this happened by this time).November 6
A notice titled "Temporary maintenance due to a cyberattack" appeared in the news list on the official Maru-Jan site (as shown by the title in the news list).November 7, 16:00
The company resumed service (it says it had identified the intrusion route and applied a fix to the abused point). Game login and the web member pages had been suspended during the emergency maintenance.November 7, 16:30
The company announced the leak of 1,855,578 members' email addresses and passwords.
- Affected group
- All Maru-Jan members (1,855,578)
- Information confirmed leaked
- Email address (where registered), password
- Not included
- Credit card numbers (the company does not hold them)
- Cause
- Unauthorized access that abused a function of the company's administration system; data including member information was downloaded externally by about 15:00 on November 4, 2026
- Response
- Identified the intrusion route and fixed the abused point; resumed service at 16:00 on November 7. Continuing to inspect servers, the administration system and work PCs, strengthen monitoring for unauthorized access, and review its information management
- Asked of members
- Change the Maru-Jan password, change the same password at other services, watch for suspicious emails
- Apology
- 3,000 points (worth 3,000 yen) per member, claimable until 24:00 on Friday, November 20
What is known and what is not
This table is based on the company's notice of November 7, as of November 9, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access and exfiltration | A function of the administration system was abused, and data including member information was downloaded externally by about 15:00 on Nov 4 | Confirmed (company) |
| Email address | Confirmed leaked. Included where registered | Leak confirmed (company) |
| Password | Confirmed leaked | Leak confirmed (company) |
| How passwords were stored | Not stated (for example whether hashed) | Not stated |
| Credit card numbers | The company does not hold them; not included | Not included (company) |
| Name, address, phone number | Not mentioned in the notice | Not stated |
| Play records, point balances, purchase history | Not mentioned in the notice | Not stated |
| Affected group | All Maru-Jan members | Confirmed (company) |
| Count | 1,855,578 members | Confirmed (company) |
| Intrusion route | Said to be identified, but the route itself is not described | Confirmed (company); details not stated |
| Misuse | Not stated. The company warns suspicious emails may arrive | Not stated |
| Service status | Resumed at 16:00 on Nov 7 | Confirmed (company) |
| Individual notices | Not stated | Not stated |
What an email address and password can be used for
The points below are what can happen in general with this pair of items; they do not mean it has happened in this incident.
Email address + password
↓→
Login attempts at other services with the same pair
→ Change the reused password elsewhere first
Email address
↓→
Fake emails posing as Maru-Jan, fake point claims
→ Do not use email links; open the official site yourself
- Login attempts at other services with the same pair: a leaked email and password pair can be tried automatically at other services. If you reused the password, it works. Email, shopping, games and social media that share the pair are all exposed.
- Fake emails to the address: messages posing as an "apology from Maru-Jan" or a "point claim" can be built to lead you to a fake page that collects your password. Because a real 3,000-point grant exists, such a message is easy to make look genuine (this site's view).
- Guessing your password habits: because the storage method is not stated, the leaked password can hint at how you build passwords elsewhere. Do not just change a trailing digit.
What operators should review: the administration system and how passwords are held
The detailed route has not been disclosed, so this covers only what the disclosed facts show.
- An administration function was used to take the data out: by the company's account, a function of the administration system was abused and data including member information was downloaded externally. Admin consoles often include a way to pull member data in bulk. In general, it helps to limit who can use such functions, from where and how often, and to log and alert on export operations.
- Review how much member data you keep: here all members were in scope (the number of downloads was not disclosed). In general, setting how long you keep data on long-inactive members, and clearing it out, shrinks what leaks in an incident.
- How passwords are stored: the notice does not say. In general, storing passwords in a form that cannot be reversed (hashing with salt) slows misuse at the services where people reused them. See Password hashing and salting.
Sources (public record)
The facts in this article come from the public information below. We have not guessed at the detailed route or at how passwords were stored.
- Signaltalk Co., Ltd., "Apology and explanation regarding the leak of member information" (November 7, 2026, notice on the official Maru-Jan site; in Japanese) — maru-jan.com
- Signaltalk Co., Ltd., "Apology and report on the leak of member information through unauthorized access to the online mahjong game Maru-Jan" (November 7, 2026, the company's press release on PR TIMES; in Japanese) — prtimes.jp
Update history
2026-11-09: First version, based on Signaltalk Co., Ltd.'s notice of November 7. We checked the official Maru-Jan site and the press release the same day and found no follow-up. The count (1,855,578) comes from the press release.
Read next
- Checking and changing passwords: How to check whether your password has leaked / Choosing a password manager
- Two-step verification: Getting started with multi-factor authentication / What is a passkey?
- Spotting fake emails: What is phishing?
- For operators: Password hashing and salting
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and overseas)