SignalTalk (シグナルトーク), the Tokyo company that runs the online mahjong service Maru-Jan, said on 7 November 2026 that an intruder had taken the email addresses and passwords of 1,855,578 members. Its apology and report, signed by president and Maru-Jan development lead Takafumi Kaya and also posted on SignalTalk’s website, says the attacker abused functions of the company’s own management system, and that data including member information had been downloaded to an outside location by about 15:00 JST on 4 November.
Email addresses were taken only for members who had registered one; credit card numbers were not involved because SignalTalk does not hold them. The notice does not say whether the passwords were stored in plain text or hashed, when the intrusion began, or whether the police or Japan’s Personal Information Protection Commission have been informed. SignalTalk says it has identified the entry route and fixed the abused function, and it reopened game logins and member web pages at 16:00 JST on 7 November after emergency maintenance.
The old passwords still work, so the reset is left to players. SignalTalk asks members to switch to a password they use nowhere else, to change it on any other service where they reused it, and to expect phishing mail posing as Maru-Jan at the leaked addresses. Each member can claim 3,000 points, which the company values at ¥3,000, until midnight on 20 November. “Resuming the service does not mean our response to this matter is over,” the notice says; checks of servers, management systems and office PCs and tighter intrusion monitoring continue. The company also acknowledges that the breach came shortly after it had briefed customers on its security measures and told them they could play with peace of mind. 4Gamer reported the release the same evening.
Maru-Jan opened on 26 April 2004 and had passed one million registered members on Windows, iOS and Android by August 2017, SignalTalk said at the time. Other Japanese game breaches this autumn mostly exposed email addresses: Capcom said an intruder accessed 11.77 million CAPCOM ID records and changed the passwords of 196 accounts, and the Gundam Base leak of 346,247 member emails did not include passwords. SignalTalk’s notice covers the passwords of all 1.86 million affected members.