medium severity November 08, 2023 · 3 min read

Chess Data Breach (2023)

If you are a customer of Chess, here’s what’s now in circulation.

In November 2023, over 800k user records were scraped from the Chess website and posted to a popular hacking forum. The data included email address, name, username and the geographic location of the user. A further 446k scraped records were later provided and added to HIBP.

On November 8, 2023, 1.3 million Chess.com user records appeared in a public data set after an attacker scraped the popular online chess platform and posted the information to a hacking forum. The breach exposed email addresses, names, usernames, and geographic locations for more than 800,000 users in the initial dump, with an additional 446,000 records added later. If you have ever created an account on Chess.com, your personal details may now sit in multiple underground repositories ready for identity thieves, stalkers, or scammers to exploit.

Named in this incident?

You can’t unleak data. You can take away what it’s worth.

A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 582 companies.

See what is exposed about you — free scan →

Not ready yet? Run a free breach check on this email

We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.

Reported Details from the Disclosure

The primary record on Have I Been Pwned states that the Chess.com incident occurred in 2023 and that the data was obtained through scraping rather than a traditional database breach. The listing confirms 1.3 million affected users and explicitly names the four categories of information exposed: email addresses, names, usernames, and geographic locations. No passwords, financial data, or government identifiers were listed in the disclosure. The platform itself has not released a separate public notification quantifying the exact scope, so the precise number of unique individuals remains tied to the HIBP tally of 1.3 million records.

Why This Matters for You and Your Family

A Chess.com account is often one of the first online identities many people, including children and teenagers, create. When names, emails, usernames, and locations leak together, the information becomes a foundation for more dangerous attacks. Scammers can craft convincing phishing emails that reference your chess rating or favorite openings. Stalkers can cross-reference your geographic location with other public records to find your home address. For families, the risk extends beyond the adult who opened the account; children’s usernames frequently become permanent handles across gaming platforms, turning one old chess breach into a lifelong link in an identity chain.

Geographic locations paired with names and emails are particularly valuable to criminals because they narrow down targets for spear-phishing, SIM-swapping, or physical intimidation. Even if you no longer play on the site, the data remains fresh and marketable years later.

You’ve used today’s 5 free articles · resets tomorrow

Create a free account to keep reading

The rest of this article comes straight back — free, no card, nothing you’ve already read goes away. Then see whether your own data is exposed too: the scan on this site is free with or without an account, and the account is what keeps the result after the emailed link expires.

Free reader account

No card, no charge. You read the blog without a limit — every article, no daily count — and it saves your exposure-scan results so you can open them again after the emailed link expires. We won’t email you anything else unless you tick the box asking us to. The next step shows what the paid plans add — free stays the first option on it.

Create a free account →

Free accounts are for personal use. If you’re reading for a company, that’s Signals (terms).

Reading this for a company?

GalaxyWarden Signals watches the organisations you name and emails you when one of them actually discloses — SEC 8-K Item 1.05 filings and corroborated breach records, with a JSON API. It monitors companies, not people: it does not scan you and does not remove your personal data.

See GalaxyWarden Signals →

Or make a free reader account first

Already have an account? Log in

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove — and removing them is what we do.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample582 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Report details & sourcing

Severity Medium

Disclosed November 08, 2023

Last reviewed July 22, 2026

Affected 1.3M

Data exposed Email addressesGeographic locationsNamesUsernames

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Related breaches

critical August 13, 2026