Chess.com Data Breach (September 2026)

What Happened

According to the Have I Been Pwned entry, millions of records said to come from Chess.com were posted online in August 2026, holding email addresses, usernames, names, countries and other data about users' Chess.com accounts. The entry says analysis of the data suggested it had been obtained by scraping, and that when it was loaded into Have I Been Pwned on September 13, 2026, 99% of the email addresses had already appeared in previous data breaches, which it says further supports the scraping theory.

Ransomnews, which analyzed the full file, reported on August 12, 2026 that a 15.5 GB file of 7,337,395 Chess.com user records was being handed out free on two data-leak forums by an account using the handle V0idix. It said the file carries email addresses, usernames, real names, countries, ratings, subscription tiers and internal advertising audience tags. Ransomnews said the records were captured in daily batches from July 26 to August 3, 2026, with 7.4% of user IDs appearing more than once, and that every structural signal points to large-scale scraping of a non-public interface rather than a compromise of Chess.com's systems. Security Affairs reported on August 14, 2026 that the data was genuine but that the evidence pointed to large-scale scraping, not a server breach.

Techlicious reported on August 14, 2026 that Chess.com had not confirmed the incident as of publication. It said the poster described the data as scraped from public profile information, but that Hackread, which obtained and reviewed the file, noted that email addresses and some account labels in it are not normally visible on public Chess.com profiles. Ransomnews said it contacted Chess.com for comment and that the company had not commented publicly on the dataset at the time of writing.

Have I Been Pwned also holds a separate, earlier entry, Chess.com (2023), which dates to November 2023 and covers 1,274,077 email addresses from user records it describes as scraped from the Chess.com website.

What Was Exposed

4 classes of data across 4,653,212 records, per Have I Been Pwned, Chess.com breach entry: email addresses, geographic locations, names and usernames.

Real names, usernames and locations tied to email addresses let an attacker write phishing that greets a player by name, quotes their Chess.com username and poses as a membership, rating or fair-play notice from the site. Ransomnews found no passwords or password hashes in the file and says account takeover using this data alone is not possible.

What to Do If You Are Affected

The full sequence, and what to do in what order, is in what to do after a data breach.

What Is Not Known Yet

Which Chess.com system exposed the advertising audience fields, which Ransomnews says the public API does not return, and whether Chess.com will notify the users whose details are in the file.