A 15.5 GB file containing records for over 7.3 million Chess.com users has appeared on data leak forums, offered freely without any ransom demands. Technical analysis confirms the data is authentic and recent, but evidence suggests it was obtained through large-scale scraping rather than a direct breach of Chess.com's servers.
The archive, a 744 MB 7-Zip file, unpacks into a tab-separated table with 7,337,395 records. Each record contains 38 fields, including common identifiers such as email addresses (present in approximately three-quarters of the records), usernames, user IDs, UUIDs, first and last names, country, location, and locale. The data also includes platform-specific information like chess titles, points, skill levels, premium status, verification flags, best ratings, and membership/last-login timestamps.
Crucially, the leaked data does not contain any passwords, password hashes, or payment information. This significantly reduces the immediate risk of account compromise for affected users.
Several details point away from a server breach. The data was not captured in a single event but appears to have been collected in daily batches over nine consecutive days, a pattern consistent with a scheduled scraping operation. Additionally, about 7.4% of the user records are duplicated, indicating that the same accounts were revisited on different days, which is not typical of a database export.
The authenticity of the data was confirmed by decoding the version-1 UUIDs embedded in the records. These UUIDs contain precise timestamps of their generation. Researchers compared these hidden timestamps from a sample of 200,000 records against the corresponding account registration dates, finding a 100% match rate. This level of precision would be impossible to fake without access to Chess.com-issued identifiers.
This incident mirrors previous data exposure events for Chess.com. In November 2023, 828,000 Chess.com records with a nearly identical field structure were published. At that time, Chess.com explicitly stated it was "NOT a data breach" and confirmed its infrastructure, member accounts, and passwords were secure. That earlier incident was attributed to the abuse of the platform's "find-friends" feature, which allowed external email addresses to be resolved against existing accounts. A subsequent scrape affected approximately 476,000 users. The current 2026 file appears to be the result of the same technique, but on a much larger scale.
One particular detail, however, complicates the pure scraping theory: the presence of Google Ad Manager audience segments in every record. These marketing-stack fields, such as "coach-nudge experiment groups," "trial eligibility," "lapsed-user cohorts," and "rating-band targeting," are not exposed through Chess.com's public API. Their inclusion suggests that the actor who compiled this data may have had access to an authenticated or internal-facing endpoint, rather than solely relying on public developer tools. Chess.com is best positioned to clarify how this specific data point was obtained.
The individual distributing the file, identified by the handle V0idix, is not attempting to monetize the data. This account has previously posted numerous free database dumps from other unrelated companies, suggesting a pattern of collecting and republishing data to build reputation rather than selling access to fresh intrusions.
While passwords were not exposed, the combination of verified email addresses with real names, countries, skill ratings, and subscription tiers provides sufficient material for sophisticated phishing attacks. Users are advised to exercise increased caution regarding unexpected emails purporting to be from Chess.com and to verify if their email address has appeared in other data breaches, as credential reuse remains a significant security risk.
