The online chess world gets a shock when Chess.com is hacked. Recently, the biggest online chess community platform in the world disclosed a major hacking attack that affected thousands of individuals. This hack revealed the personal information of over 4,500 people, raising concerns about internet safety and privacy.
The Attack Vector: Third-Party File Transfer Exploit
Vulnerabilities in a third-party file transfer protocol caused the incident. Official disclosures state that an external file transfer tool connected with Chess.com is hacked by unauthorized parties.
Hackers kept access unnoticed for almost two weeks during the event, which occurred between June 5 and June 18, 2025.
It is unclear how widespread the problem may be because this attack coincides with the discovery of serious vulnerabilities in well-known file transfer programs like Wing FTP and CrushFTP.
Company Statement on the Breach
Chess.com confirmed the incident, stating:
“The investigation has determined on June 5 and 18, 2025 an unauthorized actor gained access to the third-party file transfer application and acquired certain Chess.com data for fewer than .003% of users. Chess.com’s code and its member accounts were not compromised. As part of a third-party review of the impacted data, some of your personal information was identified among that data.”
This confirmation shows that although Chess.com is hacked , user accounts and the main platform are unaffected. However, thousands of people’s personal information remained vulnerable.
Maine Attorney General’s Report
As stated in the formal document submitted to the Attorney General’s Office of Maine:
- Total impacted users: 4,541
- Date(s) Breach Occurred: June 5, 2025
- Date Breach Discovered: June 19, 2025
The breach notice makes it clear that personal data has been handled improperly and that Chess.com is hacked, even if just a small portion of all users were impacted.
What Data Was Exposed?
Chess.com revealed that names and other unknown data elements were among the stolen material. The business stressed that no financial information was stolen.
Independent bloggers and cybersecurity researchers, however, believe the exposure might go beyond what was formally announced and might include more types of personally identifiable information (PII). This uncertainty further highlights the seriousness of the fact that Chess.com is hacked.
Response and Remediation Efforts
Chess.com has responded to the matter by taking a number of actions. Free identity theft protection is being provided to affected users, including:
- CyberScan and credit monitoring
- A $1,000,000 policy for compensation for insurance
- Completely coordinated services for recovering from identity theft
- Free protection for 12 to 24 months
The company assured users:
“To help address concerns you may have about this incident, we have arranged access to credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services at no cost to you for twelve (12)/twenty-four (24) months.”
Even while these precautions offer some comfort, the harm to confidence is obvious: Chess.com is hacked once more.
A Troubling History of Breaches
This is not the first time Chess.com is hacked. The site experienced a significant breach back in November 2023, exposing over 800,000 records. Due to an exploited API vulnerability, the following information was leaked in that incident:
- Emails
- Names and IDs of users
- Places
- Details of membership
- Points and ratings
- Registration information
The rate of these occurrences raises the question of how safe Chess.com is and whether such breaches can be avoided in the future.
The latest revelation that Chess.com is hacked highlights the rising dangers of online data breaches. Any disclosure of personal information is concerning because the site is used by millions of people globally.
