Chess.com Data Breach Investigation

Recently, Chess.com reported to the Attorney General of Maine that it had experienced a data breach in which sensitive personal identifiable information in its systems may have been compromised. According to the breach notice, on June 19, 2025, Chess.com became aware of potential unauthorized access to data stored in a third-party file transfer application used by Chess.com.¹ As a result, Chess.com launched an investigation to determine the nature of the incident.

Through its investigation, Chess.com confirmed that sensitive personal information belonging to users may have been viewed and acquired by an unauthorized third party between June 5 and June 18, 2025. As a result, Chess.com began a review of the data to determine what information had been impacted as well as identify the specific individuals affected. The exact type of personal information potentially exposed has not been made publicly available by Chess.com. However, according to state reporting guidelines, “personal information” can include the following types of information:

• Name
• Social Security number
• Driver’s license number or state identification card number
• Account number, credit card number or debit card number, with or without additional identifying information, access codes or passwords
• Account passwords or personal identification numbers or other access codes

On September 3, 2025, Chess.com began mailing data breach notification letters to impacted individuals. Based on the breach notice sent to Maine residents, Chess.com is providing affected individuals with a list of the specific types of sensitive information impacted and complimentary credit monitoring services. A link to the form breach notification that Chess.com posted to its website is below.