Online chess platform Chess.com disclosed a data breach caused by unauthorized access to a third-party file transfer application. The incident, discovered on June 19, 2025, involved an external threat actor exfiltrating data tied to 4,541 users (0.003% of its 150M+ user base) after accessing the system on June 5 and June 18, 2025. Compromised data included user names and unspecified identifiers, but no financial information was exposed. The breach did not affect Chess.com’s core systems, source code, or member accounts. The company contained the incident, engaged cybersecurity experts, and notified law enforcement. Affected users were offered 12 months of free identity protection services (credit monitoring, cyber scanning, and identity theft recovery) via IDX. No evidence of misuse or public exposure of the stolen data has been reported, though users were advised to monitor financial accounts and enroll in protection services by December 3, 2025.