Definition
Attack technique where an adversary determines whether specific users exist on a platform — typically by feeding email addresses or identifiers into search, registration, or social features and observing responses.
Key Points
- 2026-09: chess-com leak attributed to find-friends feature abuse — external email databases resolved against accounts at scale (2026-09-14-chess-com-leak-ransomnews-primary)
- 7.3M records over 9 days; internal ad-audience fields exposed beyond public API scope
- Root cause: insufficient enumeration resistance, rate limiting, and slow-scrape monitoring
- Distinct from data-breach — no server compromise required