Chess.com Data Leak Exposes 7.3 Million Users
Evidence suggests large-scale scraping, not a system breach, as the source of the leak.
1Scale of the Data Leak
A 15.5 GB file containing 7.3 million Chess.com user profiles was leaked online. The data includes email addresses, usernames, real names, countries, chess ratings, and subscription tiers. About three-quarters of the records contain email addresses. However, no passwords, password hashes, or payment information were found in the file, indicating users are not at direct security risk.
2Data Collection Method
Researchers confirmed the data was collected without breaching Chess.com's servers. Each account UUID in the file is a version-1 identifier embedding exact timestamps. Analysis of 200,000 sample records showed 100% match between these timestamps and account registration dates, proving the data's authenticity while ruling out a system breach.
3Evidence of Scraping
The data was collected in daily batches over nine consecutive days, indicating a scheduled collection process. Additionally, 7.4% of user records appear twice on different days, a pattern impossible in a genuine database export. These findings strongly suggest the data was scraped rather than stolen through a breach.
4Google Ad Manager Tags
Every record contains Google Ad Manager audience segment tags not visible in Chess.com's public API. These marketing tags include coach-nudge experiment groups, trial eligibility, and rating-band targeting. Their presence suggests the collector accessed authenticated or internal endpoints beyond public developer tools.
5Company's Previous Statements
Chess.com experienced a similar leak in 2023 involving 828,000 records, which they confirmed wasn't a data breach. That incident involved abuse of the platform's find-friends feature. The company maintained its infrastructure and member accounts remained secure. The current leak appears to be the same technique at nine times the scale.
6The Distributing Account
The account 'V0idix' sharing this data isn't monetizing it. They've previously posted dozens of free database dumps from unrelated companies, fitting the profile of a data collector rather than a hacker selling fresh breaches. This behavior further supports the scraping theory over a system compromise.
7Risks for Users
While passwords weren't exposed, the combination of emails with real names, countries, and subscription details enables targeted phishing attacks. Users should be wary of unexpected Chess.com emails and check if their email appears in other breaches. Reused credentials pose greater risks than the data in this specific file.
8Conclusions and Recommendations
This incident highlights how prevalent large-scale scraping has become. Chess.com users should focus on phishing vigilance rather than account takeover concerns. The company needs to clarify how marketing data was accessed to prevent future incidents. Enabling two-factor authentication remains a crucial security measure for all users.
Original article: Security Affairs — Chess.com'da 7.3 Milyon Kullanıcının Verileri Sızdırıldı