Loading story…
A 15.5 GB dataset allegedly sourced from Chess.com was posted for free on an underground forum, containing 7.3 million records and approximately 4.6–4.7 million unique email addresses. The records include usernames, names, countries, and Chess.com account-related information.
Have I Been Pwned added the data to its breach corpus but assessed that it was likely collected by scraping publicly accessible Chess.com web or API data rather than by compromising protected Chess.com systems. About 99% of the email addresses had appeared in earlier breach datasets; nevertheless, the combined account details can enable convincing chess-themed phishing, impersonation, and fraud.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
A 15.5 GB dataset reportedly containing about 7.3 million rows of Chess.com-associated records was published for free download on an underground forum. The records included email addresses, usernames, names, countries, and Chess.com account-related information, and were not presented as an extortion attempt.
A dataset associated with Chess.com users was reportedly collected between July 26 and August 3, 2026. Subsequent analysis assessed that the information was likely gathered through large-scale scraping of publicly accessible website or API data rather than a compromise of protected Chess.com systems.
Have I Been Pwned added the Chess.com-associated dataset to its breach corpus and found that 99% of its email addresses had appeared in previous breach datasets. This high reuse rate was cited as further support for the conclusion that the collection resulted from scraping rather than a direct Chess.com breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026
Have I Been Pwned (HIBP) has incorporated a new dataset containing 183 million unique stolen email and password pairs, sourced and aggregated by a U.S. college student known as Ben for the cybersecurity company Synthient. The dataset, totaling 23 billion rows and 3.5 terabytes, was compiled from infostealer malware logs, Telegram groups, Tor sites, and various underground forums, reflecting the industrial scale at which credentials are stolen, traded, and reused across the dark web. Security experts note that this aggregation highlights the persistent threat posed by credential theft, password reuse, and the automation of attacks, which collectively undermine digital trust and make traditional defenses less effective. The Synthient dataset is notable for its breadth, as it combines real credentials captured from infostealer malware with credential stuffing lists, rather than being the result of a single breach. This collection process demonstrates how stolen credentials move through a digital supply chain, being shared, merged, and resold repeatedly. The exposure of such a vast number of credentials underscores the importance of maintaining visibility into leaked data, enforcing multi-factor authentication, and adopting stronger authentication practices to mitigate the risks associated with widespread credential compromise.
Jun 29, 2026
Two large spam-related datasets, **Special K Data Feed** and **SC Daily Phone**, were added to Have I Been Pwned after exposing personal information tied to nearly 64 million identities in total. The records surfaced from 2015-era spam list activity and appear to have been compiled for use in unsolicited marketing or spam operations rather than from a single corporate intrusion. The exposed data in both lists included **names, physical addresses, IP addresses, genders, birth dates, and phone numbers**, creating a broad privacy risk for affected individuals. Special K Data Feed contained nearly **31 million** identities, while SC Daily Phone exposed nearly **33 million**, highlighting how large-scale spam ecosystems can aggregate and circulate detailed personally identifiable information for abuse.
Jul 12, 2026