Full Report
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
Analysis Summary
# Incident Report: Chess.com Data Scraping Exposure
## Executive Summary
In August 2026, a dataset containing 7.3 million rows of user data allegedly sourced from Chess.com was published online. Analysis indicates the data was likely obtained through large-scale web scraping rather than a direct system compromise, as 99% of the 4.6 million unique email addresses were already present in previous data breaches. The exposure included names, usernames, countries, and account-related metadata.
## Incident Details
- **Discovery Date:** September 13, 2026 (Added to HIBP)
- **Incident Date:** August 2026
- **Affected Organization:** Chess.com
- **Sector:** Entertainment / Online Gaming
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026 (approximate)
- **Vector:** Automated Web Scraping
- **Details:** Attackers utilized automated tools to harvest publicly accessible or API-exposed user profile information from the Chess.com platform.
### Lateral Movement
- **N/A:** There is no evidence of lateral movement within Chess.com’s internal network; the incident appears limited to external data harvesting.
### Data Exfiltration/Impact
- **Details:** 7.3 million rows of data were compiled and posted online. The dataset included 4.6 million unique email addresses, full names, usernames, and geographic locations.
### Detection & Response
- **Discovery:** The breach came to light when the data was posted on public forums and subsequently analyzed by security researchers and Have I Been Pwned (HIBP).
- **Response Actions:** Loading the data into HIBP for cross-referencing; notification to affected users via HIBP services.
## Attack Methodology
- **Initial Access:** Public Interface/API Scraping
- **Persistence:** N/A
- **Privilege Escalation:** None (Information was likely public-facing)
- **Defense Evasion:** Likely rotation of IP addresses to bypass rate limiting
- **Credential Access:** None (Emails were likely linked to profiles or sourced from existing breaches to correlate data)
- **Discovery:** User profile enumeration
- **Lateral Movement:** N/A
- **Collection:** Automated data harvesting (Scraping)
- **Exfiltration:** Transfer of harvested data to external forums
- **Impact:** Mass exposure of PII (Personally Identifiable Information)
## Impact Assessment
- **Financial:** No direct financial loss reported; potential secondary costs for user support.
- **Data Breach:** High volume; 7.3M records, 4.6M unique emails.
- **Operational:** Low; no reported disruption to chess server operations.
- **Reputational:** Moderate; raises concerns regarding data privacy and the platform's ability to prevent bulk automated harvesting.
## Indicators of Compromise
- **Network indicators:** High-frequency requests from non-residential IP ranges (defanged: hxxp[://]api[.]chess[.]com/pub/player/[username]).
- **Behavioral indicators:** Large-scale enumeration of user profiles in a short temporal window.
## Response Actions
- **Containment:** (Assumed) Review of API rate limiting and public profile visibility settings.
- **Eradication:** N/A (Data resides on external third-party forums).
- **Recovery:** Notification to users and recommendation of security hardening (2FA/Password resets).
## Lessons Learned
- **Public Data Aggregation:** Even if data is "public," the aggregation of millions of records creates a significant privacy risk.
- **Credential Stuffing/Correlation:** The fact that 99% of emails were in prior breaches suggests attackers are using existing leaks to "enrich" scraped data.
- **API Security:** Public APIs are frequent targets for mass data harvesting.
## Recommendations
- **Implement Robust Rate Limiting:** Enforce strict thresholds on API requests and profile views based on IP reputation and account age.
- **Data Obfuscation:** Mask sensitive identifiers (like email addresses) in public-facing profiles by default.
- **Anti-Scraping Defenses:** Deploy CAPTCHAs or Web Application Firewall (WAF) solutions designed to detect and block headless browsers and bot-like behavior.
- **User Privacy Controls:** Default user profiles to "private" or "friends-only" for new registrations to limit the footprint available to scrapers.