Chess.com Leak Exposes 7.3M Users, Evidence Points to Scraping

80 pointsposted 14 hours ago
by kristianp

23 Comments

specproc

4 hours ago

Lichess.org is an internet gem. No ads, no subs, incredible performance, low-toxicity, fully featured, free API, European.

Far superior to chess.com in all regards. If you're still on chess.com, make this your opportunity to switch. You won't regret it.

stavros

3 hours ago

I'm loving that "European" is a selling point now, but yes, agreed. Lichess is a gem.

Shank

12 hours ago

> Every record has gam_audiences and audiences_member_of populated, Google Ad Manager audience segments, with values like coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting.

It sure seems like the evidence doesn't point to scraping to me.

emodendroket

12 hours ago

I'm assuming they're basing this on the no-passwords part.

sidrag22

12 hours ago

> The data had been pulled by abusing the platform’s find-friends feature

Sounds like the find-friends feature shouldn't allow access to the majority of that data unless the "friend" accepts, don't think the "scraper" got 7mil accepts just because they had access to emails... To me this is 100% a breach, even more so because its already happened once years ago to 700k, and they changed nothing to prevent it.

jeroenhd

9 hours ago

A lot of chess.com information is public (by default) if you know someone's profile. Stuff a couple million email addresses and phone numbers into the "find friend" API and all you need to get profile information is the associated account username.

Chess.com should probably prevent scraping, but as we can read in just about every comment thread about LLMs/Cloudflare/Anubis/Go-away, that's not as easy as it sounds these days.

samus

12 hours ago

It might very well be possible that there were API endpoints that exposed way too much information. I also think that this wouldn't qualify as "scraping".

nilslindemann

11 hours ago

I just logged in to delete my chess.com account, got a message: "This account is closed, please log in with your e-Mail to reactivate". No word by them having been hacked.

Lucasoato

10 hours ago

I just got a message from an Hacker: "You seriously just played London opening as white and King Indian defense as black for the last 3 months?"

Btw I hate that chess.com puts game reviews under their most expensive plan, I ain't paying so much for something I can get in lichess for free.

gregorygoc

10 hours ago

Exactly, chess.com is at value extraction phase. Lichess is much better platform now.

mitxela

9 hours ago

Wasn't this literally always the case and the very reason lichess was created? And yet it remains #2.

demibabs

9 hours ago

Some battles are won at the domain registry.

a_c

9 hours ago

I only started playing less than a year ago. I paid for one year because of game review to improve my game. Didn't know lichess exist, but I'm not paying for a second year for sure

dwroberts

8 hours ago

Worth noting this was reported back in August, it’s not new

m00x

11 hours ago

uh oh. If my ELO gets back to my friends I'm going to be very embarrassed.

TheSpacerr

12 hours ago

Basically our data is free.

zx8080

11 hours ago

Peasants have no rights and shall be slaves.

ed_mercer

12 hours ago

email? Is a user's email up for grabs just like that?

efilife

10 hours ago

What's the forum shown in the screenshot?

unixhero

13 hours ago

Is scraping wrong that, is the question.