HIBP: 4.7 million Chess.com records leaked via scraping

The Have-I-Been-Pwned project has added around 4.7 million records from the online chess platform Chess.com to its database. The data appears to have been scraped.

This was announced by project operator Troy Hunt on the Have-I-Been-Pwned website (HIBP). The data was apparently posted online in an underground forum in August of this year, as Ransomnews reports. It was not an extortion attempt; the data was offered for download free of charge. The file reportedly has a size of 15.5 GB and is said to contain data from 7.3 million users. The collection took place between July 26 and August 3, 2026, with publication dated August 12.

Troy Hunt explains that while the database contains 7.3 million rows, it only holds 4.7 million unique email addresses along with usernames, names, countries, and information related to Chess.com accounts. When integrating into the data collection, 99 percent of the email addresses had already appeared in other data breaches. According to Hunt, this supports the scraping theory.

Data scraped from the web

Scraping involves the programmatic reading and copying of data directly from a website or its APIs. The data is thus actively provided by the provider, and attackers merely read it out on a large scale. This at least results in qualified data, as a context is known. If cybercriminals want to attack the affected individuals, they can assume that chess is an interesting topic for the people behind the email addresses. This makes more targeted phishing or similar fraud attempts possible.

Last November, for instance, it became known that IT researchers from Austria had scraped around 3.5 billion data records from WhatsApp using scraping. They did not crack any encryption to do this. In 30 percent of cases, users themselves provided information in the “Info” field that revealed political leanings or sexual and religious orientation, as well as email addresses and links to social networks. Users should re-check what information they actually want to make publicly available and adjust their entries accordingly in forums and social networks.

(dmk)