Chess.com User Data Leak Exposes 7.3M Records, Likely Due to Scraping

Millions of Chess.com User Records Leaked

A 15.5 GB file containing 7,337,395 Chess.com user records has been distributed on data-leak forums. The file, offered at no cost, includes a wide range of user information such as email addresses, usernames, user IDs, real names, countries, chess titles, skill levels, premium status, and various rating data. Approximately three-quarters of the records contain an email address.

Internal Marketing Data Included

Notably, the leaked data also contains internal Google Ad Manager audience segments, such as 'coach-nudge experiment groups' and 'lapsed-user cohorts'. These marketing-stack fields are not typically available through Chess.com's public API, suggesting a more comprehensive data collection method than simple public profile scraping.

Scraping Suspected, Not a Breach

Technical analysis by Ransomnews indicates the data is genuine and recent. However, the absence of passwords, password hashes, or payment information suggests the data was not obtained via a direct system breach. Instead, evidence points to data scraping, as the records were stamped across nine consecutive days in daily batches, a pattern consistent with a scheduled collection job rather than a single moment of compromise.

Data Authenticity Confirmed

Researchers verified the authenticity of the data by decoding timestamps embedded in account UUIDs. By comparing these generation timestamps with account registration dates across 200,000 sample records, a 100% match rate was achieved. This level of precision would be impossible to fake without access to actual Chess.com-issued identifiers down to the millisecond.

Impact on Users

While the absence of passwords and payment data mitigates the most severe risks, the exposure of personal information like email addresses and real names could still lead to phishing attempts or targeted spam. Users should remain vigilant for suspicious communications, although immediate password changes are not indicated as necessary due to this specific leak.