Chess.com's 7.3 Million-Record Leak Looks Scraped, And It Dragged Ad Segments Along

A 15.5 GB file containing more than 7.3 million chess.com user records was posted to two data-leak forums this week at no cost and with no ransom demand attached ^[1]. According to a technical analysis by Ransomnews, cited by Security Affairs, the data is genuine and recent but is not the product of a hack ^[2] - and the most interesting thing in it is not the user data at all, but the advertising cohort labels riding alongside it ^[8].

The mechanics first. The archive is a single 744 MB 7-Zip file that expands into a tab-separated table with one header row and 7,337,395 records of 38 fields each ^[3]. The schema is chess.com-specific end to end: email, partial email, username, user ID, UUID, first and last name, country, location and locale, plus platform state such as chess title, points, skill level, premium status and label, verification and activation flags, best rating and rating type, official rating, and member-since and last-login timestamps ^[4]. Roughly three-quarters of records include an email address ^[5], which puts the exposed mailbox count somewhere around 5.5 million ^[6]. There are no passwords, no password hashes and no payment data anywhere in the file ^[7].

The authenticity check did not require touching chess.com. Every account UUID is a version-1 identifier, which embeds the timestamp of its own generation; researchers decoded that timestamp across a 200,000-record sample and compared it to each account's registration date, getting a 100% match ^[9]. That is hard to forge without real chess.com-issued identifiers.

The same analysis argues the collection was scraped rather than dumped. Records are stamped across nine consecutive days in daily batches, the signature of a scheduled job rather than a single export ^[10], and about 7.4% of accounts appear twice, revisited on different days ^[11] - roughly 543,000 duplicated records, which a database export does not produce ^[12]. This is familiar ground. In November 2023, 828,000 chess.com records surfaced with a near-identical field set, and the company told Hackread flatly, "This was NOT a data breach," adding that "Our infrastructure, member accounts, and data such as passwords are secure" ^[13]. That set was harvested by abusing the platform's find-friends feature to resolve externally sourced email lists against real accounts ^[14], and a second scrape of roughly 476,000 users followed ^[15]. Ransomnews describes the new file as the same technique at roughly nine times the scale ^[16], which the record counts support ^[17].

One field pair breaks the public-scrape story. Every record has gam_audiences and audiences_member_of populated with Google Ad Manager audience segments, carrying values including coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting ^[8]. Those are marketing-stack attributes, not profile data, and they do not appear in chess.com's public API ^[18]. Ransomnews reads that as evidence the collector was hitting an authenticated or internal-facing endpoint rather than public developer tools ^[19]. The operational lesson is not about chess ratings. It is that response payloads assembled for a logged-in client tend to include whatever the ad and experimentation stack attached upstream, and a scraper gets the A/B bucket and the churn label for free.

The account distributing the file, using the handle V0idix, is not selling anything; the same handle has posted dozens of free database dumps from unrelated companies ^[20].

Watch whether chess.com names the endpoint that returned audience segments, and whether it repeats the 2023 line that this was not a breach ^[13].