Abused admin-system feature at Japanese online mahjong service Maru-Jan exposes passwords and emails of 1.85M members

SignalTalk said on November 7 that its online mahjong service Maru-Jan suffered unauthorized external access, confirming the email addresses and passwords of 1,855,578 members were leaked ^[1]. The company said an attacker abused a feature of its management system and downloaded data containing member information externally around 15:00 on November 4; it identified the intrusion path, fixed the abused component and resumed service at 16:00 on November 7 ^[1][2]. Maru-Jan members should promptly switch to a new password not used on other services, change it anywhere the same password was reused, and act only via the official site rather than links in suspicious emails ^[1].

Industries mainly affected: Media, entertainment & gaming

1. Maru-Jan members should promptly change to a password not used on other services via the official member page ^[1].
2. Change the password on any other service (email, shopping sites, etc.) where the same password was used .