The SignalTalk data breach is the unauthorised download of the email addresses and passwords of all 1,855,578 members of Maru-Jan, the online mahjong service operated by SignalTalk Inc. SignalTalk disclosed the breach on 7 November 2026, three days after the download, and resumed the service the same day. The leaked items were email addresses and passwords only. Credit card numbers were not part of the leak, because SignalTalk does not hold them.
Two documents carry the disclosure. The first is the company notice published on 7 November 2026, timed 16:30 JST. The second is the member-facing explanation on the Maru-Jan site, updated at 16:37 the same day. Japanese trade press reported the announcement the same day, Toyo Keizai republished the release in full, and the company notice is the primary source for every fact in this article.
Download, disclosure and resumption#
SignalTalk said data including member information was downloaded externally by around 15:00 on Wednesday 4 November 2026, after unauthorised access that abused a function of the company's management system. The notice names no vulnerability, product or attacker. It also says nothing about how the access was first detected, and it gives no date for the first discovery. Three days passed between the download and the disclosure on 7 November, so the notice leaves members unable to tell how long an attacker held the data before the warning arrived.
After the discovery, the company put the service into emergency maintenance, suspending game logins and the web member page while the work went on. The service resumed at 16:00 on Saturday 7 November 2026, the same day SignalTalk disclosed the breach. SignalTalk apologised for the wait during maintenance and for the leak.
SignalTalk said the intrusion route has been identified, and countermeasures have been applied to the part of the system that was abused. The work continues past resumption. The company listed continuing checks of servers, the management system and business PCs, stronger monitoring for unauthorised access, a review of information management, and continued investigation of weaknesses beyond the one already found. Further findings and progress are to be reported on the official site.
Records in the leaked set#
The scope is the whole membership. SignalTalk put the number at 1,855,578 members, and the notice states the scope as every member of the service. An email address was affected where a member had registered one. Email addresses and passwords are the confirmed leaked items, and the notice itemises nothing else.
How the passwords were stored is not stated. SignalTalk did not say whether they were plaintext, hashed, salted or stretched, and no secondary source read for this article adds that detail. The distinction matters, because plaintext passwords can be used at once while properly hashed passwords take far more work to crack. Members cannot assume the safer case, since the notice does not state it. The company's own instruction points the same way: every member was asked to change the password, which is the instruction for passwords treated as usable.
Credit card numbers were not part of the leak. SignalTalk does not hold them. That single fact removes payment card numbers from the exposed data entirely, because a company cannot leak card numbers it never collected. No other data types appear in the company's list. Names, addresses, phone numbers, dates of birth and payment data are not mentioned, and this article does not claim they leaked or that they did not. The notice is silent on those items, and silence in a first disclosure is not evidence either way.
Misuse is unconfirmed in either direction. The notice says neither that the leaked data has been used, published or sold, nor that it has not. It also contains no statement about a report to Japan's Personal Information Protection Commission or to police.
Response and compensation#
Members were told to change the Maru-Jan password to one not used on any other service, and to change the same password on any other service where it had been reused. They were also told to beware of suspicious mail impersonating Maru-Jan. Old passwords still work for login, the company noted, and members were asked not to keep using them. Password changes are made from the official Maru-Jan member page, and the company warned members against reaching that page through links in mail.
Takafumi Kaya, SignalTalk's president and Maru-Jan development lead, signed the apology in the notice. Kaya said the company had emailed members about security measures shortly before the incident, telling them the service was safe to use. That message asked for trust, he said, and the breach broke it.
As an apology, each member was offered 3,000 points, worth 3,000 yen. The points are claimed from the points claim page on the Maru-Jan site, and the claim deadline is 24:00 on Friday 20 November 2026. The offer is compensation for the incident, not a security measure. Claiming it does not change the password advice.
Taken together, the response had four parts: fix the abused system, resume the service, tell members what to change, and offer compensation.
Credential stuffing risk#
Every member is in the leaked list, not only active players. The list is the full membership record, so it holds the addresses and passwords of people who may not have opened the service recently as well as regular players.
An email address on its own is mainly a phishing risk, and a password on its own is a risk only to the account it belongs to. Together the two are a different problem. The address identifies the person, and the password can be tried against other services where the same combination was reused. That practice is called credential stuffing. It works because password reuse is common. With 1,855,578 matching pairs, an attacker can test them against mail providers, shopping sites, banks and social networks, and each reused password that matches opens another account.
The phishing risk follows directly from the leak. SignalTalk warned that mail impersonating Maru-Jan may arrive at the leaked addresses. A message naming the service, referring to the breach and linking to a fake password change page is easy to build from the public facts, and the leaked addresses give the sender a real audience. The company's advice covers this: members should not follow links in mail claiming to be from Maru-Jan, and password changes should be made from the official site. The wider pattern is set out in how phishing uses a leaked email address.
Member password changes and inbox checks#
The company's instructions set the order of action. The Maru-Jan password comes first: a new password, not used on any other service, set from the official member page. The same password should then be changed on every other service where it was used, starting with the email account itself, because that account is the recovery route for most other accounts.
Members can also check whether the Maru-Jan email address appears in other known breaches. Have I Been Pwned lists breaches by email address and shows which incidents exposed a given address, so a member can see every breach tied to that address. At the time of writing, no Have I Been Pwned listing for this breach existed. That is expected three days after disclosure, so members should check again once the breach is added.
The inbox needs watching for mail impersonating Maru-Jan. Any message about the breach, the password change or the 3,000 points that asks the reader to click a link should be treated as suspicious, and the action should be done from the official site instead. The points claim deadline of 20 November 2026 is a detail a forged message can copy. Urgency in a message is not evidence that the message is genuine.
SignalTalk warned members to beware of suspicious mail impersonating Maru-Jan. Password changes should be made from the official Maru-Jan site, reached directly, not through a link in mail claiming to be from the service.
Two limits apply to the advice. A new Maru-Jan password protects the Maru-Jan account, but it does nothing about copies of the old password already held by the attacker. The reused copies elsewhere must also change, for that reason. The company has not said how the passwords were stored, so no member can judge from the notice how quickly the passwords can be used. The general steps for a breached address are set out in what to do when an email is in a data breach, and the password question is covered in does changing your password stop hackers.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
AliasFleet and breached email addresses#
AliasFleet provides a separate email alias for each website a user signs up to. One address is used in one place. If an address used only for Maru-Jan appeared in a later breach, the source of the leak would be identifiable from the address itself. That alias could then be paused or replaced, without changing the address used anywhere else. AliasFleet does not prevent a breach at a service. It does not protect a password reused across services either. What it does is limit the spread of a leaked address, because the address is not the same address the user gives to other sites. The password advice in this article still applies in full to AliasFleet users.
Other Japanese member-system breaches#
The Maru-Jan breach is the latest in a run of Japanese member-system breaches disclosed in October and November 2026. Lawson disclosed unauthorised access to its Lawson ID and app reservation systems affecting about 2,155,000 member IDs, as covered in the Lawson data breach. Bookoff Group Holdings disclosed unauthorised access to a subsidiary member-management system covering up to about 6.43 million member records, as covered in the Bookoff data breach. Daiichi Kosho disclosed a contractor terminal malware infection with up to 8.72 million customer records possibly affected, as covered in the Daiichi Kosho data breach. Each incident differs in vector, scope and data. This article does not claim a common cause.
Remaining questions#
SignalTalk has promised further updates on its official site as the investigation continues. Three questions remain open: the password storage format, whether any misuse has been confirmed, and whether a regulator report was made.
