Chess.com data breach 2026: what happened and what to do

What happened

In August 2026, a file of records said to come from Chess.com appeared online. Have I Been Pwned (HIBP) loaded it in September and counted 7.3 million rows containing 4,653,212 unique email addresses. The rows also carried usernames, names, countries and details about the accounts.

The data does not look like the output of a classic hack. HIBP's analysis points to scraping, meaning someone collected the details from public or semi-public parts of the site, or its interfaces, at scale. One sign is that 99% of the email addresses had already appeared in earlier breaches, which is what you'd expect from a list built from existing sources. Security Affairs, citing an independent analysis, reached the same view. Hackread reported that the method hasn't been independently confirmed, and that Chess.com hadn't given it a substantive answer when it asked for comment.

Whether it counts as a breach or a scrape is a real debate. Troy Hunt, who runs HIBP, has written about when a scrape becomes a breach. For you the practical answer is the same: your details are in a file other people can read.

What was exposed

According to HIBP, the data covers email addresses, usernames, names and geographic locations. Reports say it contains no passwords, no password hashes and no payment details.

That is less serious than a password leak, but it isn't harmless. A list that links a real email address to a username and a place is useful to scammers. They can write messages that mention your chess handle or your city, which makes a fake "your account is locked" email look more believable. Because so many of these addresses were already in older leaks, anyone who reused a password across sites was already at risk before this one.

The company's response

Chess.com had not publicly confirmed the cause or size of the incident when the data was reported. Hackread said its request for comment received only an automated acknowledgement. The page will be updated if the company publishes a statement.

Until then, the numbers that matter are HIBP's: 4,653,212 unique email addresses, loaded on 13 September 2026, from data first posted in early August. Chess.com is a large platform with many millions of registered players, so the file covers a slice of its members and not necessarily all of them.

What you can do now

You don't need to panic, since no passwords were involved. Do check that your Chess.com password isn't one you use elsewhere, turn on two-factor authentication, and treat any email that mentions your username with suspicion until you've gone to the site directly.

One more habit worth having: use a separate email address for hobby sites. If that address leaks, it doesn't link back to your bank or your work inbox.

If your email shows up in HIBP for this incident, it was in the file. If it doesn't, you may still be in other breaches, so a broader check is worth five minutes.