Chess.com (2026) scraped data of 4.6M unique email addresses added to Have I Been Pwned
In August 2026, a dataset of 7.3M rows allegedly sourced from Chess.com was posted online, containing 4.6M unique email addresses. The data also included usernames, names, countries and account-related data. Analysis suggests the data was obtained by scraping rather than a direct breach of Chess.com systems. Have I Been Pwned added it on 13 Sep 2026 and found that 99% of the email addresses had already appeared in earlier breaches, which supports the scraping theory. Because the data is largely recycled, the main risk is targeted phishing and credential-stuffing against affected users.
Technical Details
- Dataset size: 7.3M rows, 4.6M unique email addresses.
- Exposed fields: email addresses, usernames, names, countries and Chess.com account data.
- Collection method: assessed as scraping, based on the 99% overlap with previously breached addresses.
- The article does not name a threat actor or confirm any compromise of Chess.com infrastructure.
Remediation
- Change the password on any account where the affected password was reused.
- Use a password manager to generate unique passwords.
- Enable 2FA wherever it is supported.
Linha do tempo
-
Chess.com (2026) scraped data of 4.6M unique email addresses added to Have I Been Pwned
ler a análise desta fonte ocultar
In August 2026, a dataset of 7.3M rows allegedly sourced from Chess.com was posted online, containing 4.6M unique email addresses. The data also included usernames, names, countries and account-related data. Analysis suggests the data was obtained by scraping rather than a direct breach of Chess.com systems. Have I Been Pwned added it on 13 Sep 2026 and found that 99% of the email addresses had already appeared in earlier breaches, which supports the scraping theory. Because the data is largely recycled, the main risk is targeted phishing and credential-stuffing against affected users.
Technical Details
- Dataset size: 7.3M rows, 4.6M unique email addresses.
- Exposed fields: email addresses, usernames, names, countries and Chess.com account data.
- Collection method: assessed as scraping, based on the 99% overlap with previously breached addresses.
- The article does not name a threat actor or confirm any compromise of Chess.com infrastructure.
Remediation
- Change the password on any account where the affected password was reused.
- Use a password manager to generate unique passwords.
- Enable 2FA wherever it is supported.