Chess.com user data surfaces online after mass scraping, not a breach

A dataset containing more than 4.6 million unique email addresses linked to Chess.com user profiles has been added to the breach-notification service Have I Been Pwned, after the information was scraped from publicly accessible features of the chess platform rather than obtained through a breach of its systems.

Have I Been Pwned indexed the dataset on Sept. 13, 2026, listing email addresses, usernames, real names, geographic locations and other details tied to individual Chess.com accounts as the exposed information. No passwords, password hashes or financial information were included.

The data had reportedly first surfaced online in early August 2026. A threat actor using the name V0idix initially claimed to be offering, for free, a 15.5-gigabyte file containing 7,337,395 Chess.com user records collected between July 26 and Aug. 3, 2026, posted across two leak forums. Those records reportedly included email addresses, usernames, real names, countries, chess ratings, subscription tiers and internal advertising audience tags, in addition to the fields HIBP later indexed.

Troy Hunt, the creator of Have I Been Pwned, said an analysis of the data indicates it was obtained through scraping rather than a breach of Chess.com’s systems. Hunt said that when the emails were loaded into HIBP, 99% of them had already appeared in previous data breaches, which he said further supports the scraping theory. That level of overlap is considered a hallmark of data aggregated from publicly accessible sources rather than material freshly stolen from an internal system, a distinction HIBP says matters when assessing real-world risk. Scraping involves using automated software to collect information that is already visible to the public or accessible through public-facing features and APIs, rather than breaching a company’s defenses to obtain hidden data.

Although no passwords or financial information were exposed, the combination of usernames, locations and email addresses can still give scammers material for targeted phishing campaigns.

This is not the first time Chess.com user data has surfaced in a large scraped dataset. In November 2023, more than 800,000 Chess.com user records appeared on a cybercrime forum after an attacker scraped information through the platform’s API.

Large-scale scraping has repeatedly turned publicly available information into datasets used by criminals. In 2025, attackers claimed to have scraped 1.2 billion Facebook user records by abusing one of the platform’s APIs, in a sample that included user IDs, names, email addresses, phone numbers, locations, birthdays and genders. LinkedIn has faced a similar problem, including a 2021 dataset of 500 million profiles offered for sale that included names, email addresses, phone numbers and workplace information. In 2025, a service also advertised access to 1.8 billion Discord messages belonging to 35 million users, along with voice session data and information from thousands of servers.

Chess.com account holders can check whether their information was exposed through HIBP’s email search tool.