A large dataset containing information on more than 7.3 million Chess.com users is being shared for free on two data leak forums.
The 15.5 GB dataset contains 7,337,395 user records. It includes email addresses, usernames, names, countries, chess ratings, subscription information and internal advertising audience tags.
The data was reportedly collected between July 26 and August 3, 2026, and was disclosed on August 12. According to an analysis by Ransomnews, the information appears to be genuine Chess.com data.
However, the available evidence does not point to a traditional data breach.
Instead, the structure of the dataset suggests that someone collected the information over time by scraping a non-public part of the Chess.com platform.
What the leaked data contains
The dataset is stored in a 744 MB 7-Zip archive that expands to about 15.5 GB. It contains one table with 38 fields and more than 7.3 million records.
The information includes usernames, user IDs, UUIDs, email addresses, names, countries, locations and account locales. It also contains account information such as chess titles, ratings, skill levels, premium status, verification flags and account activity dates.
About three quarters of the records reportedly contain an email address.
The dataset does not appear to contain passwords, password hashes or payment information. That means users should not assume their Chess.com passwords or payment details were exposed based on this dataset alone.
Some of the more unusual information is found in two fields called gam_audiences and audiences_member_of.
These fields contain Google Ad Manager audience information. Examples include groups related to trial eligibility, inactive users, experiments and rating based advertising.
These are not ordinary public profile fields and are not included in the Chess.com public API.
Evidence points to scraping
The most important question is not whether the data is real. It is how it was obtained.
Several details suggest that the dataset was collected gradually rather than taken directly from a compromised database.
The records have capture dates covering nine days, from July 26 through August 3. The number of records collected varied from roughly 72,000 to 267,000 per day.
That pattern looks more like an automated collection process running over several days than someone downloading an entire database at once.
There are also a significant number of duplicate users.
Around 7.4% of the user IDs appear more than once. Many of those repeated accounts were recorded on different days, while the information in the rows changed slightly between captures.
That is consistent with a scraper returning to accounts and collecting updated information.
A database export would normally not contain multiple versions of the same user record in this way.
The UUIDs also appear genuine
The analysis found another strong indication that the records came from Chess.com.
Of the 169,289 valid version 1 UUIDs examined, 169,287 contained creation timestamps that matched the account’s member_since value down to the second.
UUID version 1 values can contain a creation timestamp. The matching timestamps suggest that these are genuine identifiers issued by Chess.com rather than identifiers fabricated by the person distributing the dataset.
The total number of records also matches the 7,337,395 records claimed by the distributor.
There is a history of Chess.com scraping
This is not the first time Chess.com users have been affected by large scale scraping.
In November 2023, a threat actor published information connected to about 828,000 Chess.com accounts. The dataset contained a similar collection of user information.
At the time, Chess.com said the incident was not a data breach and that its infrastructure, user accounts and passwords were secure.
The earlier incident involved the platform’s find friends functionality. Attackers used externally obtained email addresses to discover whether those addresses were connected to Chess.com accounts and then collected information returned by the service.
Another scrape later affected hundreds of thousands of users.
The latest dataset appears to follow a similar pattern, but on a much larger scale.
What users should do
There is currently no evidence in the dataset that passwords or payment information were exposed.
Even so, users should be careful about targeted phishing emails.
Because the dataset contains email addresses, names, usernames, locations and information about account status, criminals could use it to create convincing messages aimed at Chess.com users.
Users should avoid clicking unexpected links claiming to offer account upgrades, password resets, prizes or security alerts.
It is also a good idea to use a unique password for Chess.com and enable any additional account security features that are available.
Chess.com has been contacted
Ransomnews says it contacted Chess.com about the dataset and was waiting for a response at the time of publication.
The data was not being sold. Instead, the distributor known as V0idix reportedly released it for free on two leak forums, although one copy was placed behind a reply-to-unlock requirement.
For now, the evidence points to a large scale scraping operation rather than a direct compromise of Chess.com’s internal systems.
That distinction is important. A dataset can contain genuine and sensitive user information without hackers having broken into the company’s core infrastructure.
The full impact will depend on how the data was collected and whether Chess.com identifies the non-public interface or functionality that allowed such a large amount of information to be gathered.
