Chess.com file with 7.3 million genuine profiles points to scraping, not a breach

What surfaced

A compressed archive holding 7,337,395 Chess.com user records was posted for free on two data-leak forums this week, according to SecurityAffairs. The 744 MB 7-Zip file expands into a 15.5 GB tab-separated table with one header row and 38 fields per record, and the schema is Chess.com-specific throughout.

Alongside the obvious identifiers — usernames, user IDs, UUIDs, real names, countries, locations and email addresses, which appear in roughly three quarters of records — the file carries platform state: chess titles, points, skill levels, premium subscription tiers and labels, verification and activation flags, best and official ratings, plus member-since and last-login timestamps. What it does not contain is passwords, password hashes or payment data.

How the data was verified

According to SecurityAffairs, which cites a technical analysis by Ransomnews, proving the records genuine required no access to Chess.com's servers. Every account UUID in the file is a version-1 identifier, a format that embeds the exact moment it was generated. Researchers decoded those hidden timestamps across 200,000 sample records and compared them to each account's registration date; the match rate came back at 100%, something the report argues could not be faked without holding genuine Chess.com-issued identifiers down to the millisecond.

Why the evidence points to scraping

SecurityAffairs highlights several details that fit scheduled collection rather than a database dump. The records are stamped across nine consecutive days in daily batches, not captured in a single moment. And about 7.4% of user records appear twice — the same accounts revisited on different days — which would not happen in a genuine export from a live database.

There is also precedent. In November 2023, a threat actor published 828,000 Chess.com records with a near-identical field set. Chess.com's response then, as told to Hackread, was blunt: "This was NOT a data breach. Our infrastructure, member accounts, and data such as passwords are secure." That data had been pulled by abusing the platform's find-friends feature, feeding externally sourced email addresses into it to resolve them against real accounts. A second scrape affecting roughly 476,000 users followed. SecurityAffairs describes the new file as the same technique running at roughly nine times the scale.

The detail that does not fit

Two fields at the end of each row complicate the pure-scraping story. Every record carries gam_audiences and audiences_member_of — Google Ad Manager audience segments, with values such as coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting. These are marketing-stack fields, not profile data, and they do not appear in Chess.com's public API. Their presence on every single row suggests whoever compiled the file had access to an authenticated or internal-facing endpoint rather than just the public developer tools. SecurityAffairs calls this the question Chess.com is best positioned to answer.

The account distributing the file, using the handle V0idix, is charging nothing and making no ransom demand. The same handle has posted dozens of free database dumps from other unrelated companies, a pattern SecurityAffairs reads as a collector building reputation through volume rather than someone selling access to a fresh intrusion.

Why it matters

The absence of passwords does not make this harmless. A verified email sitting next to a real name, country, skill rating and subscription tier is enough raw material for a convincing phishing message about a membership renewal or a fair-play dispute. The practical response is to treat unexpected Chess.com emails with more suspicion than usual and to check whether the same address has surfaced elsewhere, since reused credentials remain a far more dangerous exposure than anything in this particular file.

The larger question is for Chess.com itself: if the advertising-audience data never leaves the public API, the company needs to explain which endpoint exposed it, and whether that path has now been closed.