SignalTalk: Maru-Jan breach exposes 1.86 million members’ passwords

An attacker abused a management-system function and downloaded member data by around 15:00 on 4 November. The official news list announced emergency maintenance for a cyberattack on 6 November; the member count and exposed fields were published on 7 November. [2] [3]

All 1,855,578 members are affected: passwords and, where registered, email addresses leaked. The password storage format was not disclosed. Credit card numbers were not held and are excluded. [3]

Game logins and web member pages were suspended. The 02:30 update on 7 November described further attacks and a delayed restart. After identifying the entry route and addressing the abused function, service resumed at 16:00 that day. Checks of servers, management systems and work PCs, monitoring and investigation of other weaknesses continue. [1] [3]

SignalTalk asks members to change their passwords, including reused passwords on other services. It offers each member 3,000 points worth JPY3,000, claimable until midnight at the end of 20 November. [3]