A 15.5 GB file containing 7,337,395 chess.com user records is being handed out free on two data-leak forums. It carries email addresses, usernames, real names, countries, ratings, subscription tiers and internal advertising-audience tags. Ransomnews verified the data against the file itself. It is genuine chess.com data, and it is days old, not a recycled dump. What it is not, on the evidence, is a break-in: every structural signal points to large-scale scraping of a non-public interface rather than a compromise of chess.com’s systems.
A note on what we are publishing. This dataset is the personal data of millions of real people. We reproduce none of it. Our analysis is statistical: counts, validation rates, timestamp decoding and distributions, never individual records. We do not link the file, do not name the hosting service, and have redacted the download URL, the seller’s messaging contacts and every sample row from the screenshots. We did not query chess.com’s API to test records against live accounts.
What is in the file
The archive is a single 744 MB 7-Zip file that expands to a 15.5 GB tab-separated table: one header row and 7,337,395 records, each with 38 fields. The schema is chess.com-specific throughout. Alongside the obvious identifiers, email, partial email, username, user ID, UUID, first and last name, country, location and locale, it carries platform state: chess title, points, skill level, premium status and label, verification and activation flags, best rating and rating type, official rating, member-since and last-login timestamps.
Two fields at the end are the interesting ones. Every record has gam_audiences and audiences_member_of populated, Google Ad Manager audience segments, with values like coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting. Those are marketing-stack fields, not profile data. They do not appear in chess.com’s public API.
Roughly three-quarters of records carry an email address. There are no passwords, no password hashes and no payment data anywhere in the file. That matters for how users should react, and we come back to it below.
How we verified it
The decisive test does not require touching chess.com at all. The dataset stores each account’s UUID, and those UUIDs are version 1, the time-based variant, which embeds the exact moment the identifier was generated. If the data were fabricated or assembled from unrelated sources, those embedded timestamps would be random noise. If it came from chess.com, each UUID’s embedded time should match the account’s registration date.
We decoded the timestamp out of every version-1 UUID in a 200,000-record slice and compared it against the same row’s member_since value. 169,287 of 169,289 matched to within three seconds. That is 100.00%. Two outliers in 169,289 is noise. Nobody can manufacture that correlation without genuine chess.com-issued identifiers, because it would require knowing the millisecond each of millions of accounts was created and then minting valid UUIDs backwards from it. The data is authentic.
| Check | Result | What it means |
|---|---|---|
| UUID embedded time vs. member_since | 169,287 / 169,289 match (100.00%) | Genuine chess.com-issued identifiers |
| Record count | 7,337,395 rows, 38 fields, uniform | Matches the advertised 7 million |
| Records carrying an email | 74.7% | Consistent with the “4M+ emails” claim |
| Capture window | 26 July to 3 August 2026, daily batches | Days old, not a recycled dump |
| Duplicate user IDs | 7.4%, none byte-identical | Same users re-captured on later dates |
| Registration years | 2017 to 2026, peaking 2020 to 2023 | Matches the platform’s growth curve |
| Passwords or payment data | None | No credential exposure in this file |
The country and provider distributions behave like a real consumer platform rather than a generated list: the United States dominates at about two-thirds, followed by the United Kingdom, Canada, Colombia, India, Australia and Brazil, and the email domains run gmail, yahoo, hotmail, aol, icloud in the proportions you would expect. Premium tiers sit at roughly 97% free with small diamond, platinum and gold populations, and two staff accounts.
Why this looks scraped, not breached
Authenticity and intrusion are separate questions, and the second one is where most coverage of leaks like this goes wrong. Three findings point the same way.
First, the capture dates. A database export is a single moment in time. This file is stamped across nine consecutive days, 26 July to 3 August 2026, in uneven daily batches ranging from about 72,000 to 267,000 records. That is a job running on a schedule, not a table being dumped.
Second, the duplicates. About 7.4% of user IDs appear more than once, and when we compared those repeat rows, 35,032 of 35,384 were the same account captured on a different day, with zero byte-identical pairs. A collector revisiting accounts produces exactly this. A database dump does not contain the same primary key twice.
Third, the precedent. In November 2023 a threat actor published 828,000 chess.com records with a near-identical field set. Chess.com’s response then was unambiguous: as it told Hackread, “This was NOT a data breach. Our infrastructure, member accounts, and data such as passwords are secure.” The data had been pulled by abusing the platform’s find-friends feature, feeding in externally sourced email addresses to resolve them against accounts. A second scrape affecting roughly 476,000 users followed. This 2026 file is the same technique at roughly nine times the scale.
The one detail that does not fit a purely public scrape is the advertising-audience data. Segment membership is not something chess.com’s public API hands out, and it appears on every single row. That suggests an authenticated or internal-facing endpoint rather than the open developer API, and it is the question chess.com is best placed to answer. Chess.com also disclosed a separate incident in June 2025 involving a third-party file-transfer application, which affected about 4,500 people, a reminder that the platform’s exposure has more than one route.
Who is distributing it
The account, using the handle V0idix, registered on the first forum in late May 2026 and has fifteen messages, zero reputation and a handful of reactions. On the second forum the same handle joined in early May 2026 and has been busier: forty threads, forty-two posts, a reputation score of ten. The two profiles share an identical avatar and posting style, and the chess.com thread appears on both with the same sample rows and the same wording.
The thread history is the useful part. Alongside chess.com sit free dumps attributed to Alcon, Panera Bread, Mercer Advisors, Russia’s gosuslugi.ru government services portal and a Brazilian company, several of them described as Salesforce-sourced record sets. Nothing is priced. This is a distributor building reputation by giving volume away, not a broker monetising a fresh intrusion, which is consistent with a collector who harvests and republishes rather than someone with access to sell.
What chess.com users should do
Start with what is not at risk. There are no passwords, hashes or payment details in this file, so there is no reason to believe accounts can be logged into using it, and a password reset is not the urgent step it would be after a credential breach. Turning on two-factor authentication is still worth doing, but it addresses a different threat.
- Expect targeted phishing. The dangerous combination here is a verified email address next to a username, real name, country, rating and premium tier. That is enough to write a convincing message about a membership renewal, a rating dispute or a fair-play review. Treat unexpected chess.com email with suspicion, and reach the site directly rather than through links.
- Watch for account-recovery bait. Someone holding your username and registration date can sound authoritative in a support-impersonation attempt. Chess.com will not ask for your password.
- Check the address, not just the account. If the email in this set is one you reuse elsewhere, the reuse is the exposure. Our StealerCheck tool shows whether an address has surfaced in stealer logs, which is a materially worse category of exposure than this one.
- Titled and streaming players deserve extra care. The file flags chess titles, ratings and staff accounts, which makes high-profile users trivially filterable for targeted social engineering.
What this means beyond chess.com
Scraped data gets dismissed because “it was already public,” and that framing does not survive contact with a file like this. Individually, a username and a country are trivia. Assembled into 7.3 million rows joining an email address to a real name, a location, a skill level and a paid-subscription flag, and refreshed daily, it becomes a targeting database. The aggregation is the harm, and it is why several regulators now treat mass scraping of personal data as a reportable event regardless of whether a system was breached.
The operational lesson for platforms is narrower. Chess.com was scraped this way in 2023, said so publicly, and it has happened again at nine times the volume with marketing-segment fields attached. Enumeration resistance, rate limiting and monitoring for slow, wide harvesting across days are the controls that matter here, and they are the ones that get deprioritised precisely because the endpoint being abused is not considered sensitive.
We approached this the way we approach every listing on Ransomtracker: assume the poster is exaggerating, then check what they handed over. In this case the data held up completely, which is the less common outcome. We have contacted Chess.com for comment, including a direct question about which system exposes the advertising-audience fields, and we are awaiting a response. The company has not commented publicly on this dataset at the time of writing. We will update this article with its statement when we receive one. Press contact for this piece is [email protected].
Frequently asked questions
Is the chess.com leak real?
Yes. We verified it against the full dataset. Every version-1 UUID in a 200,000-record sample carries an embedded creation timestamp matching that account’s registration date to the second, a 100.00% match rate that is only possible with genuine chess.com-issued identifiers.
Were chess.com passwords leaked?
No. The file contains no passwords, no password hashes and no payment data. Account takeover using this data alone is not possible, so the urgent risk is phishing rather than compromised logins.
How many chess.com users are affected?
The file holds 7,337,395 records, though about 7.4% are the same account captured on more than one date, so the number of distinct users is somewhat lower. Roughly three-quarters of records include an email address.
Was chess.com hacked?
The evidence points to scraping rather than a breach. The data was captured in daily batches over nine days with repeat users, which is a harvesting pattern, not a database export. Chess.com said a near-identical 2023 leak was API abuse and not a breach of its systems.
How recent is the data?
Very. Capture timestamps run from 26 July to 3 August 2026, so the file is days old rather than a recirculated older dump.
What should I do if I use chess.com?
Treat unexpected chess.com emails with suspicion, particularly about memberships, ratings or fair-play reviews, and navigate to the site directly instead of clicking links. Enable two-factor authentication, and check whether the email address you use there has appeared in stealer logs.
Is this the same as the 2023 chess.com leak?
It is the same technique at much larger scale. The 2023 incident exposed 828,000 records through abuse of the find-friends feature. This one covers 7.3 million and adds internal advertising-audience fields that the public API does not expose.
Sources and further reading
- Ransomnews Research Team analysis of the full 15.5 GB dataset, 12 August 2026 (aggregate statistics only)
- Hackread: hacker leaks 828,000 scraped chess.com user records (2023), with chess.com’s response
- Cybernews: chess.com users exposed via a third-party file-transfer application (2025)
- teiss: chess.com faces a second data leak affecting over 476,000 users
- StealerCheck: check whether an address appears in stealer logs
- Ransomtracker: live leak-site and listing tracker