Third-party breach hits Chess.com

BleepingComputer reports that internet chess portal and social networking site Chess.com had data from more than 4,500 of its 100 million users pilfered following a June attack against its third-party file transfer application.

Threat actors who breached the third-party app between June 5 and 18 were able to exfiltrate unspecified personally identifiable information, but not any financial details, according to Chess.com, which emphasized the lack of evidence showing misuse of the stolen data.

"Upon becoming aware of the incident, we started an investigation, retained leading experts, notified federal law enforcement, and began taking measures to address the incident," Chess.com said in breach notices to affected users, who have been given up to two years of complimentary identity theft and credit monitoring services.

Such a third-party breach comes almost two years after Chess.com had more than 800,000 users' records, including full names, usernames, email addresses, and location details, compromised in an attack involving an API vulnerability.