Chess.com (2026) data breach: 4.7M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-09-13
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Aug 3, 2026; Have I Been Pwned loaded it on Sep 13, 2026.
What to do
- If you had a Chess.com (2026) account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch