SignalTalk, the Japanese company behind the online mahjong service Maru-Jan, has confirmed that the email addresses and passwords of all 1,855,578 of its members were leaked in an unauthorised access incident. The company announced the breach on 7 November 2026 and restored the service the same afternoon after several days of emergency maintenance.

According to SignalTalk, attackers misused a function of the company's management system to download data containing member information. The company says it confirmed that the data had been downloaded externally by around 3pm on Wednesday 4 November. It says the intrusion route has been identified and that countermeasures have been applied to the part of the system that was misused.

Game logins and the web member pages were suspended while the company investigated and carried out emergency maintenance. The service resumed at 4pm on Saturday 7 November. SignalTalk said its work was not finished with the resumption of service and that it would continue inspecting servers, management systems and business computers, strengthening monitoring for unauthorised access and reviewing its information management arrangements.

The company said every Maru-Jan member is affected. The confirmed leaked information is email addresses, where registered, and passwords. SignalTalk does not hold credit card numbers, so payment card details were not part of the leak. The company has not said how the passwords were stored, whether the leaked data has been misused, or when the unauthorised access began.

SignalTalk is asking all members to change their Maru-Jan password immediately, even though the old password still works, and to choose a password not used on any other service. Anyone who used the same password elsewhere, including for email or online shopping, should change those passwords too. The company also warned that phishing emails pretending to come from Maru-Jan may arrive at the leaked addresses, and said password changes should be made through the official website, never through links in suspicious emails.

As an apology, SignalTalk is offering 3,000 points, worth 3,000 yen, to every member. The points can be claimed from the point claim page on the Maru-Jan website until midnight on Friday 20 November. In a statement, company president Takafumi Kaya apologised, saying the incident had betrayed the trust of customers who had believed the company's recent reassurances about security, and that regaining that trust would depend on the company's actions from now on.

The company said it would publish further findings and progress on countermeasures on its official website as they became available. Members who are unsure whether they are affected should check the official Maru-Jan website and change their password there.