Chess.com discloses recent data breach via file transfer app

Chess[.]com has disclosed a data breach after threat actors gained unauthorized access to a third-party file transfer application used by the platform. The incident occurred in June 2025, with the attackers maintaining access for two weeks between 5 June and 18 June, and Chess[.]com only discovering the breach on 19 June 2025.

The breach affected just over 4,500 users, a very small percentage of the platform’s roughly 100 million users, and the data that may have been accessed includes names and other personally identifiable information, though no financial information was exposed.

Chess[.]com states that its own infrastructure and member accounts remained unaffected, and it has notified federal law enforcement and taken additional measures to secure its systems, while offering impacted members 1–2 years of free identity theft and credit monitoring. The company notes that it has no evidence the stolen data has been publicly disclosed or misused yet, and it did not name the third-party app involved.

In November 2023, Chess[.]com suffered another incident when over 800,000 user records were scraped from its site via an API flaw, with information such as email addresses, full names, usernames and geographic locations exposed, according to HaveIBeenPwned.