Chess Data Breach (2023)

On November 8, 2023, 1.3 million Chess.com user records appeared in a public data set after an attacker scraped the popular online chess platform and posted the information to a hacking forum. The breach exposed email addresses, names, usernames, and geographic locations for more than 800,000 users in the initial dump, with an additional 446,000 records added later. If you have ever created an account on Chess.com, your personal details may now sit in multiple underground repositories ready for identity thieves, stalkers, or scammers to exploit.

Reported Details from the Disclosure

The primary record on Have I Been Pwned states that the Chess.com incident occurred in 2023 and that the data was obtained through scraping rather than a traditional database breach. The listing confirms 1.3 million affected users and explicitly names the four categories of information exposed: email addresses, names, usernames, and geographic locations. No passwords, financial data, or government identifiers were listed in the disclosure. The platform itself has not released a separate public notification quantifying the exact scope, so the precise number of unique individuals remains tied to the HIBP tally of 1.3 million records.

Why This Matters for You and Your Family

A Chess.com account is often one of the first online identities many people, including children and teenagers, create. When names, emails, usernames, and locations leak together, the information becomes a foundation for more dangerous attacks. Scammers can craft convincing phishing emails that reference your chess rating or favorite openings. Stalkers can cross-reference your geographic location with other public records to find your home address. For families, the risk extends beyond the adult who opened the account; children’s usernames frequently become permanent handles across gaming platforms, turning one old chess breach into a lifelong link in an identity chain.

Geographic locations paired with names and emails are particularly valuable to criminals because they narrow down targets for spear-phishing, SIM-swapping, or physical intimidation. Even if you no longer play on the site, the data remains fresh and marketable years later.

Doxxing and Identity-Chain Implications

Once a username from Chess.com appears in a leak, attackers can pivot to every other service where that same handle is reused. Gaming accounts, forum profiles, social media, and even school-related logins often share identical usernames. This creates a doxxing cascade: an adversary starts with your chess email and location, finds your Discord or Roblox account using the same username, then maps those handles back to your real-world identity. Children’s gaming profiles are especially vulnerable because parents rarely monitor them with the same vigilance as adult email accounts. The result is a complete identity profile that can be sold once or used repeatedly for harassment, account takeovers, or fraud.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to break those connections where possible.
• Rotate the password used at Chess.com anywhere it has been reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same usernames and addresses.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing active accounts.

The Chess.com scrape is a reminder that even seemingly harmless hobby sites can expose enough personal information to fuel serious identity crimes years after the fact. A single breach like this rarely stays isolated; it becomes the first link in chains that adversaries patiently follow. Starting with a DoxxScan gives you both immediate visibility into those chains and ongoing protection through continuous monitoring, identity-chain mapping, hands-on remediation by specialists, and household coverage that includes your family’s gaming accounts.