HackingTechnologyRetail & ConsumerInformationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIILowContained
Chess.com, LLC
bd_da3bc401913fa8ba · schema v1 · pii pii-v1
Full breach record for Chess.com, LLC →On June 19, 2025, Chess.com discovered that an unauthorized actor had gained access to a third-party file transfer application used by the company on June 5 and 18, 2025, acquiring data for fewer than 0.003% of users. Chess.com's own systems and member accounts were not compromised. Personal information including names and certain other data elements was obtained. 4,541 individuals were affected total; 1 Maine resident. The incident was contained and law enforcement was notified.
Maine clockDiscovered Jun 19, 2025 → Filed with AG Sep 3, 202576d ⏱ ME AG >30d11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_d4f40ff3bc1d6ae0Indiana State AGfiled 2025-09-03Verified
- bd_fcd24aa03b555a7dVermont State AGfiled 2025-09-03Verified
- bd_51094529e07762bfNew Hampshire State AGfiled 2025-09-08(5d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c605e260-6f98-4a2d-b21d-7ab9d7d16127.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 3, 2025
- Raw hash
- 78e5a461a7e2b45cef0d8d969054d22f85719cee9db1bdd49f5d0cffe4ea9d18
Reporting entity
- Name
- Chess.com, LLCnorm: chesscom
- Domain
- chess.com
- Industry
- Other Commercial
Victim entity
- Name
- Chess.com, LLCnorm: chesscom
- Domain
- chess.com
- Industry
- Other Commercial
- Industry
- TechnologyllmRetail & Consumerllm
Incident
- Discovered
- Jun 19, 2025
- Materiality determined
- —
- Notification sent
- Sep 3, 2025
- Affected individuals
- 1
- Data types
- PII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1213 Data from Information Repositories
- Threat actor
- External
- Regulator citations
- Notified federal law enforcement
- Initial access
- trusted_relationship
Compliance
- Time to disclose
- 11 weeks(76 days from discovery to filing)
- Compliance flags
- ME AG >30d · 76dME resident >60d · 76d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 19, 2025→ Filed with AG: Sep 3, 202576d 30 days (soft) ME AG >30d Maine Discovered: Jun 19, 2025→ Notified: Sep 3, 202576d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.