Chess.com Leak Exposes 7.3 Million Users — Evidence Points to Scraping
A free 15.5 GB leak exposed 7.3 million Chess.com user records; analysis suggests large-scale scraping via find-friends rather than a server breach.
A 15.5 GB dump containing 7,337,395 Chess.com records appeared on leak forums posted by user V0idix at no cost. Ransomnews confirmed the data is genuine by validating embedded v1 UUID timestamps against registration dates, but found daily-batch collection over nine days and ~7.4% duplicate records, pointing to scraping. The schema includes emails, ratings, subscription tiers and internal Google Ad Manager audience segments not exposed in the public API, and contains no passwords or payment data. Chess.com reported a similar 828,000-record 2023 leak from find-friends abuse and said then that it was not a breach.
- 7.3 million records leaked free by V0idix, no ransom demand
- Data collected in daily batches over nine days, suggesting scheduled scraping
- Includes internal Google Ad Manager segments, hinting at authenticated endpoint access
- No passwords or payment data exposed; phishing risk remains
- Mirrors 2023 scrape of 828,000 records via find-friends feature
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | chess.com | react. Proving this data is genuine didn’t require touching chess.com’s servers at all. Every account UUID in the file is a versi |
From the original article
4 min read at securityaffairs.com
7. 3 million Chess. com profiles leaked online: the data is genuine, but evidence points to large-scale scraping, not a server breach.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.