Massive Chess.com User Data Leak Exposes 7.3 Million Profiles via Large‑Scale Scraping
What Happened — A 15.5 GB archive containing 7,337,395 Chess.com user records was posted on two public leak forums. The data includes emails, usernames, real names, location, subscription tier, rating information and internal Google Ad Manager audience tags. Researchers verified the authenticity of the records and found no evidence of a server breach; the pattern points to systematic web‑scraping over nine days.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates a classic control‑gap scenario where publicly‑facing endpoints allow bulk extraction of personally identifiable information, a situation SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) are designed to prevent and evidence.
- Continuous control mapping and automated evidence collection (Verisq Control Mapping) give you a defensible audit trail that shows rate‑limiting, bot‑detection and data‑minimisation controls are in place and operating.
Who Is Affected — Online gaming/entertainment platforms, consumer‑facing SaaS services that expose user‑profile APIs or public pages.
Recommended Actions
- Review and harden rate‑limiting, CAPTCHA, and bot‑detection on all public endpoints.
- Map the new controls to SOC 2 CC6.1 and CC7.1, capture configuration snapshots, and store them as continuous audit evidence.
- Conduct a data‑classification audit to confirm that no unnecessary fields (e.g., internal marketing tags) are exposed via public interfaces.
Technical Notes — The leak was a tab‑separated file (38 fields per record). No passwords or payment data were present. Timestamps embedded in UUID‑v1 values matched registration dates, confirming authenticity. The collection appears to have been automated, pulling data in daily batches over a nine‑day window. Source: SecurityAffairs