Chess.com Data Breach via Third-Party File Transfer Application
Summary
Hide â˛
Show âŧ
Chess.com experienced a data breach in June 2025, where unauthorized actors accessed a third-party file transfer application used by the platform. The breach affected approximately 4,500 users, exposing names and other personally identifiable information (PII). The incident was discovered on June 19, 2025, and the platform has since taken measures to secure its systems and notify affected users. Chess.com is a large online chess platform with over 100 million users. The breach did not affect the platform's own infrastructure or member accounts directly. The platform is offering free identity theft and credit monitoring services to affected users. This is the second cyber incident reported by Chess.com in recent years, following an API flaw exploit in November 2023 that exposed over 800,000 user records.
Timeline
-
04.09.2025 20:51 đ° 1 articles
Chess.com Data Breach via Third-Party File Transfer Application
In June 2025, Chess.com disclosed a data breach where unauthorized actors accessed a third-party file transfer application used by the platform. The breach affected approximately 4,500 users, exposing names and other personally identifiable information (PII). The incident was discovered on June 19, 2025, and the platform has since taken measures to secure its systems and notify affected users. Chess.com is offering free identity theft and credit monitoring services to those impacted.
Show sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
Information Snippets
-
The breach occurred between June 5 and June 18, 2025.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
Approximately 4,500 users were affected, out of a total user base of 100 million.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
Exposed data includes names and other personally identifiable information (PII).
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
No financial information was exposed, and there is no evidence of data misuse.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
Chess.com has notified law enforcement and is offering free identity theft and credit monitoring services to affected users.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
The breach did not affect Chess.com's own infrastructure or member accounts directly.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
-
Chess.com suffered a previous data breach in November 2023, where over 800,000 user records were exposed due to an API flaw.
First reported: 04.09.2025 20:51đ° 1 source, 1 articleShow sources
- Chess.com discloses recent data breach via file transfer app â www.bleepingcomputer.com â 04.09.2025 20:51
Similar Happenings
Salesloft OAuth breach exposes Salesforce customer data via Drift AI chat agent
A threat actor, UNC6395, exploited OAuth tokens associated with the Drift AI chat agent to breach Salesloft and access customer data across multiple integrations, including Salesforce, Google Workspace, and others. The breach occurred between August 8 and 18, 2025, affecting over 700 organizations, including Zscaler, Palo Alto Networks, Cloudflare, Google Workspace, PagerDuty, Proofpoint, SpyCloud, and Tanium. The attackers targeted Salesforce instances and accessed email from a small number of Google Workspace accounts, exporting large volumes of data, including credentials and access tokens. Salesloft and Salesforce have taken steps to mitigate the breach and are advising affected customers to revoke API keys and rotate credentials. Salesloft will temporarily take Drift offline to enhance security. UNC6395 demonstrated operational security awareness by deleting query jobs, indicating a sophisticated approach. The breach highlights the risks of third-party integrations and the potential for supply chain attacks. The breach is unrelated to previous vishing attacks attributed to ShinyHunters. UNC6395 systematically exported large volumes of data from numerous corporate Salesforce instances, searching for secrets that could be used to compromise victim environments. The campaign is not limited to Salesforce customers who integrate their own solutions with the Salesforce service; it impacts all integrations using Salesloft Drift. There is no evidence that the breaches directly impacted Google Cloud customers. Organizations are urged to review all third-party integrations connected to their Drift instance, revoke and rotate credentials for those applications, and investigate all connected systems for signs of unauthorized access. The blast radius of the Salesloft Drift attacks remains uncertain, with the ultimate scope and severity still unclear. Numerous companies have disclosed downstream breaches resulting from this campaign, including Zscaler, Palo Alto Networks, Proofpoint, Cloudflare, and Tenable. Zscaler and Palo Alto Networks warned of potential social engineering attacks resulting from the campaign. Cloudflare confirmed that some customer support interactions may reveal information about a customer's configuration and could contain sensitive information like access tokens. Okta successfully prevented a breach of its Salesforce instance by enforcing inbound IP restrictions, securing tokens with DPoP, and using the IPSIE framework. Okta recommends that organizations demand IPSIE integration from application vendors and implement an identity security fabric unified across applications. Palo Alto Networks' Unit 42 recommends conducting an immediate log review for signs of compromise and rotating exposed credentials. The breach started with the compromise of Salesloft's GitHub account between March and June 2025. UNC6395 accessed the Salesloft GitHub account and downloaded content from multiple repositories, added a guest user, and established workflows. Reconnaissance activities occurred between March 2025 and June 2025 in the Salesloft and Drift application environments. Salesloft isolated the Drift infrastructure, application, and code, and took the application offline on September 5, 2025. Salesloft rotated credentials in the Salesloft environment and hardened the environment with improved segmentation controls between Salesloft and Drift applications. Salesforce restored the integration with the Salesloft platform on September 7, 2025, but Drift remains disabled. 22 companies have confirmed they were impacted by the supply chain breach. ShinyHunters and Scattered Spider were also involved in the Salesloft Drift attacks.
Allianz Life data breach affects 1.1 million customers via Salesforce compromise
Allianz Life, a U.S. insurance subsidiary of Allianz SE, experienced a data breach in July 2025. Hackers accessed a third-party cloud CRM system, stealing personal information of 1.1 million customers. The breach involved a malicious OAuth app linked to Salesforce instances, leading to the exfiltration of sensitive data. The extortion group ShinyHunters, tracked as UNC6040, claimed responsibility and leaked the stolen data. The breach is part of a broader campaign targeting multiple high-profile companies, including Google, Adidas, Workday, Qantas, Pandora, and Workiva. Allianz Life confirmed the breach but declined to provide additional details due to an ongoing investigation. Qantas Group executives reduced their short-term compensation by 15% due to the impact of the cyberattack on customers, which affected approximately 5.7 million passengers.