Chess.com User Data Exposed in Large-Scale Scraping Incident In early August 2026, a dataset containing over 4.5 million unique email addresses linked to Chess.com accounts surfaced online. The breach notification service Have I Been Pwned (HIBP) indexed the data on September 13, 2026, revealing that the exposed records included email addresses, usernames, real names, geographic locations, and other account-specific details. The dataset, initially claimed by the threat actor V0idix, was advertised as a 15.5 GB file containing 7.3 million records scraped between July 26 and August 3, 2026. The leaked information reportedly extended to player ratings, subscription tiers, and internal advertising tags. Analysis indicates the data was scraped from public sources rather than obtained through a direct breach of Chess.com’s systems. HIBP noted that 99% of the exposed email addresses had appeared in prior breaches, reinforcing the theory that the information was aggregated from publicly accessible sources. This distinction is critical, as scraped data typically poses a lower risk than material stolen directly from internal databases. The incident highlights the ongoing risks of publicly exposed user data, even when no direct system compromise occurs. Chess.com, the world’s largest online chess platform, has not confirmed a breach, but affected users can verify their exposure through HIBP’s search tool.

Online chess platform Chess.com disclosed a data breach caused by unauthorized access to a third-party file transfer application. The incident, discovered on June 19, 2025, involved an external threat actor exfiltrating data tied to 4,541 users (0.003% of its 150M+ user base) after accessing the system on June 5 and June 18, 2025. Compromised data included user names and unspecified identifiers, but no financial information was exposed. The breach did not affect Chess.com’s core systems, source code, or member accounts. The company contained the incident, engaged cybersecurity experts, and notified law enforcement. Affected users were offered 12 months of free identity protection services (credit monitoring, cyber scanning, and identity theft recovery) via IDX. No evidence of misuse or public exposure of the stolen data has been reported, though users were advised to monitor financial accounts and enroll in protection services by December 3, 2025.