Data breach
Chess.com data breach
In 2026, Chess.com suffered a data breach affecting 5,439,538 records. Exposed data included email addresses, partial email address, username and 7 other types of data.
Breach date
5.4 million
Records in the breach
10
Types of data exposed
Were you affected by the Chess.com breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Chess.com breach
- Email Addresses
- Partial Email Address
- Username
- User Id
- Uuid
- First Name
- Last Name
- Country
- Location
- Game Information
About the breach
In August 2026, a massive data dump containing 7.3 million user profiles (with roughly 4.6 million unique email addresses) allegedly sourced from Chess.com appeared on leak forums.
What Happened
• Nature of the Incident: Security analysis and independent researchers point to large-scale data scraping (mass public harvesting via lookups/APIs) rather than a direct server intrusion or hack of Chess.com's core infrastructure.
• Exposed Data: The records include usernames, user IDs, real names, email addresses, countries/locations, chess titles, Elo ratings, subscription/membership tiers, and account timestamps.
• What Was Safe: No passwords, password hashes, or financial/payment data were present in the leaked dataset.
Previous Incidents for Context
• June 2025 Third-Party Breach: A separate, smaller incident occurred between June 5 and June 18, 2025, where an exploit in a third-party file transfer tool exposed personal data (names and identifiers) for 4,541 users. Chess.com notified those users in September 2025.
• November 2023 Scraping: An earlier API-scraping incident exposed over 800,000 user records.
Risks and Recommended Actions
• Primary Risk: Targeted phishing. Because attackers have real names, email addresses, and subscription statuses, they may send convincing fake emails about membership renewals, rating reviews, or fair-play bans.
What Happened
• Nature of the Incident: Security analysis and independent researchers point to large-scale data scraping (mass public harvesting via lookups/APIs) rather than a direct server intrusion or hack of Chess.com's core infrastructure.
• Exposed Data: The records include usernames, user IDs, real names, email addresses, countries/locations, chess titles, Elo ratings, subscription/membership tiers, and account timestamps.
• What Was Safe: No passwords, password hashes, or financial/payment data were present in the leaked dataset.
Previous Incidents for Context
• June 2025 Third-Party Breach: A separate, smaller incident occurred between June 5 and June 18, 2025, where an exploit in a third-party file transfer tool exposed personal data (names and identifiers) for 4,541 users. Chess.com notified those users in September 2025.
• November 2023 Scraping: An earlier API-scraping incident exposed over 800,000 user records.
Risks and Recommended Actions
• Primary Risk: Targeted phishing. Because attackers have real names, email addresses, and subscription statuses, they may send convincing fake emails about membership renewals, rating reviews, or fair-play bans.
How to protect yourself
In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.