6.4 Million Chess.com Records Scraped and Posted on Telegram

HEROIC's analysts recorded 6,444,209 records tied to Chess.com, the online chess platform, after they were scraped from public profile data and posted to Telegram in August 2026. The set includes email addresses, usernames, and first and last names pulled from accounts across the platform, distributed by an actor known online as V0idix.

Because this was a scrape of publicly viewable profile information rather than a break in to internal systems, no passwords were part of what leaked, but the identifying details still carry real risk on their own.

Why This Is Dangerous

A verified list of millions of real email addresses tied to real names and usernames is valuable to scammers precisely because it confirms who is active on a specific platform, making follow up phishing messages far more convincing than a random guess.

What Was Exposed

• Email addresses give attackers a direct, working channel for phishing attempts.
• Usernames let attackers match this data against other platforms where the same handle may be used.
• First and last names add personal detail that makes a scam message look legitimate.

Why This Matters

No passwords leaked here, so accounts are not directly at risk of takeover through this data alone. The real danger is phishing and impersonation, since an attacker can reference a person's real name, chess handle and email together to make a fraudulent message look like it comes from Chess.com itself.

How a Database Scrape Like This Happens

Rather than breaching Chess.com's internal systems, this data was collected by systematically pulling public profile fields at scale, a technique known as scraping, then compiled into one large dataset and shared through cybercrime channels on Telegram.

Is Your Chess.com Email in This Dataset?

Scan your email to check. If it turns up, stay alert for messages that reference your Chess.com username or real name, and avoid clicking links in unexpected emails claiming to be from the platform, whether they land in a personal or work inbox.