---
id: 6567
title: "Hacking Chess.com and Accessing 50 Million Customer Records"
source_domain: samcurry.net
source_url: "https://samcurry.net/hacking-chesscom"
published_at: "2020-12-16T00:00:00Z"
tags: ["bug-bounty", "account-takeover", "api-security", "mobile-security", "chess-com", "signature-bypass"]
phying_url: "https://phying.com/item/6567"
lang: en
---

# Hacking Chess.com and Accessing 50 Million Customer Records

## Summary

Sam Curry recounts hacking Chess.com's mobile API: signed requests to api.chess.com seemed untamperable, until a flaw in how signatures were verified led to full takeover of any user account.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2020-12-16T00:00:00Z
- **Original:** https://samcurry.net/hacking-chesscom
- **Phying News:** https://phying.com/item/6567