The widely used online platform for chess enthusiasts and social networking, Chess.com, is facing another data breach. The breach, confirmed by Chess.com, involves threat actors exploiting the platform’s API’s “find friends” feature to extract publicly available user data. The compromised information, affecting nearly 476,000 users, was leaked on the notorious Breach Forums over the weekend.
This incident follows a similar data breach reported earlier, where threat actors disclosed a scraped database containing information from approximately 828,327 Chess.com users. The leaked data includes full names, usernames, profile links, email addresses, users’ originating countries, avatar URLs, Universal Unique Identifier (UUID), user IDs, and registration dates. Notably, this latest data leak is distinct and unrelated to the previous one, as clarified by a post on Breach Forums.
The threat actor behind the recent leak asserted, “I scraped everything, and nothing was reused from the 800k leak.” A verification by Hackread.com supports the authenticity of this claim, affirming that no data from the earlier breach has been incorporated into the current one. The group responsible for the initial Chess.com data leak, known as “DrOne,” has claimed access to four additional scraped databases comprising personal information from over 1 million Chess.com users. However, the timeline for the potential leak of these databases remains uncertain.
Meanwhile, Chess.com emphasized that it has not fallen victim to a cyber attack, and threat actors have not compromised its servers. In response to the previous scrape leak, Chess.com stated that malicious actors exploited its public API but assured users that their infrastructure, member accounts, and data, including passwords, remain secure.
Chess.com’s representative explained, “Today, we learned that some bad actors used our API to collect and release some publicly available member data. This was NOT a data breach. Our infrastructure, member accounts, and data such as passwords are secure.” Acknowledging that the leaked information is publicly available, including email addresses in the compromised data, poses a significant threat to users.
Chess.com urged users to remain vigilant and cautious of potential phishing attempts, emphasizing its commitment to user security and ongoing efforts to address and mitigate the impact of the recent data leaks. The platform advises users to update passwords and encourages strong, unique passwords to enhance account security. The situation is evolving, and Chess.com assured users that it will promptly monitor and respond to any emerging threats.https://www.teiss.co.uk
