Maru-Jan says email addresses and passwords of 1,855,578 members were taken

Signal Talk, the Tokyo company behind the online mahjong game Maru-Jan, said an outsider used a function in its management system to download member data. The download happened by around 3:00 p.m. on November 4, 2026. The company has now told every member that their email address and password were taken.

What happened

In a press release dated November 7 (in Japanese), and in a note to members (in Japanese) from representative director and development lead Takafumi Kaya, Signal Talk gives this account:

• The people affected are all Maru-Jan members, 1,855,578 of them.
• The data confirmed to have left the system are email addresses and passwords. Email addresses are included where the member had registered one.
• The company does not hold credit-card numbers, so those were not part of this leak. It points to its privacy page for what it stores.
• Staff identified the path the attackers used, closed it, and resumed the service at 4:00 p.m. on November 7 after an emergency maintenance that had blocked game logins and the web member pages.
• Investigation is still going. The company says it is checking servers, the management system and work PCs, strengthening monitoring, and looking for weaknesses beyond the one that was used.

Kaya wrote that the company had only recently emailed members about security measures and asked them to keep enjoying the game with peace of mind. He apologised for failing to protect the information after that message.

What this means for you

A password paired with an email address is enough for someone to try that same login on other sites. It is also enough to send a message that looks like it comes from Maru-Jan, asking you to “confirm your account” or “claim compensation points.” Signal Talk is offering 3,000 points to each member as an apology, claimable from the official member page until midnight on November 20. A real offer like that is exactly the sort of detail a copycat email will try to reuse.

The company says older passwords still work, which is why it is asking people not to keep using them.

What you can do

1. Change your Maru-Jan password from the official site, not from a link in an unexpected email. Signal Talk’s password-change page is linked from the member notice. Choose a password you do not use anywhere else.
2. If you reused the old password on email, shopping or any other account, change those too, and turn on multi-factor authentication where you can.
3. Treat unexpected mail, texts or chats about Maru-Jan as suspect, even if they use your address or mention the points offer. Open the site the way you usually do, not through the message.
4. See how scammers use leaked data to make a message feel personal if a note arrives that seems to know you.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• How scammers use leaked data to make phishing personal: what an email address and a password are worth to someone writing a fake account notice.

Sources

• Signal Talk, Apology and report on the leak of member information from unauthorised access to the online mahjong game Maru-Jan (in Japanese), November 7, 2026
• Maru-Jan, Apology and explanation about the leak of member information (in Japanese), November 7, 2026