# Chess.com Data Leak Exposes 7.3 Million Users Internal marketing data found in scraped user records raises new questions - **Source:** [Hacker News: Front Page](https://brifing.si/source/b07aa772-b1a0-4a76-aa18-719c6f9e2dde) - **Published:** 2026-09-14 - **Original article:** - **On Brifing:** https://brifing.si/s/2fe2093d-e47b-4f61-83c1-ed4284bf278f ## The Scale of the Leak A 15.5 GB file containing 7.3 million chess.com user records appeared on data-leak forums this week. The dataset includes emails, usernames, real names, countries, chess ratings, and subscription tiers. Notably, about three-quarters of records contain email addresses, but no passwords or payment information were exposed. The data's authenticity was confirmed by analyzing account UUID timestamps against registration dates with 100% accuracy. ## Unusual Marketing Data Exposure Each record contains internal Google Ad Manager audience segments - marketing data not available through chess.com's public API. These tags reveal experiment groups, trial eligibility, and user cohorts used for targeted advertising. The presence of this proprietary marketing stack information suggests access beyond public developer tools, raising questions about how the data was obtained. ## Evidence Points to Scraping Three technical details indicate scraping rather than hacking: 1) Data was collected across nine consecutive days in batches, 2) 7.4% of records appear twice from different collection days, and 3) The file structure matches chess.com's API schema. These patterns are inconsistent with a database breach but typical of automated data collection from public endpoints. ## Historical Precedent Chess.com experienced similar leaks in 2023 (828,000 records) and 2024 (476,000 records), both from abusing the 'find-friends' feature. The company maintained these weren't breaches but scraping incidents. The current leak represents a ninefold increase in scale using the same technique. Chess.com's infrastructure and passwords remain secure according to their previous statements. ## The Distributor's Profile The account 'V0idix' distributing the file has posted dozens of free database dumps from unrelated companies. Their pattern suggests a data collector rather than a hacker - building reputation through volume of leaks rather than selling access. This contrasts with typical ransomware actors who monetize breaches immediately. ## Potential Internal Access The inclusion of advertising audience data in every record suggests possible access to authenticated or internal endpoints. This data isn't exposed through public APIs, indicating the scraper may have had elevated privileges. Chess.com is best positioned to clarify whether this represents a security boundary being crossed. ## User Risk Assessment While passwords weren't exposed, the combination of emails, real names, locations, and subscription details enables highly targeted phishing. Users should scrutinize unexpected chess.com emails regarding membership renewals or fair-play disputes. Reused credentials pose greater risk than the leaked data itself. ## Broader Implications This incident highlights how scraping can achieve breach-scale impacts without system intrusion. It challenges traditional security models focused on perimeter defense. For platforms like chess.com with public APIs, balancing data accessibility with user protection remains an ongoing challenge, especially as scraping tools become more sophisticated. ## Sources covering this story - https://securityaffairs.com/197174/breaking-news/chess-com-leak-exposes-7-3-million-users-evidence-points-to-scraping.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._