Zacks zacks.com Zacks data breach 2024: what happened and what to do
In June 2024, Zacks Investment Research was allegedly breached and the data was later posted to a hacking forum. Have I Been Pwned counts about 12 million email addresses, with names, phone numbers, physical and IP addresses, usernames and unsalted SHA-256 password hashes.
View all 13,115 breaches- Breach date
- 22 Jun 2024
- Affected
- 11,994,223
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Zacks Investment Research is a US investment research company known for its stock ratings. In June 2024, according to Have I Been Pwned (HIBP), it was allegedly breached, and the data was later posted to a hacking forum. In late January 2025 a forum user claimed to have taken customer records from Zacks' databases. HIBP added the data on February 12, 2025 and counts 11,994,223 unique email addresses.
This was not Zacks' first incident. HIBP says the 2024 data is a superset of an earlier breach that Zacks confirmed in 2023, so some people appear in both. Zacks did not respond when HIBP tried to contact it about the 2024 incident, and BleepingComputer also reported no reply to its questions. For that reason the word "allegedly" matters: the breach is verified by HIBP, but Zacks has not publicly confirmed the details.
What was exposed
HIBP lists these types of data: email addresses, IP addresses, names, passwords, phone numbers, physical addresses and usernames. The passwords were stored as unsalted SHA-256 hashes. A hash is a scrambled version of a password, and unsalted hashes of common passwords can be cracked quickly, because the same password always produces the same hash.
What criminals can do with it
The combination of name, phone number, home address and email is what scammers want. An investment research customer is also a likely target for investment fraud: fake "analyst" calls, bogus stock tips and phishing that claims your Zacks account has a problem. Texts and calls may use your real name and address to sound legitimate.
Password reuse is the other risk. If your Zacks password was weak or matched one you use elsewhere, attackers can try it on your email, your bank and your brokerage. Anyone with an account at an investment firm should treat a leaked password as urgent.
What Zacks has said
Zacks hasn't published a statement about the 2024 incident. Zacks does have a page about its earlier breach at zacks.com/breach. Check Zacks' own site for updates rather than following links in emails.
Was your data included
Check your email on Have I Been Pwned. A free Serus scan also checks your email and phone number against this and other breaches. Serus can't remove breach data, but it monitors for new exposures and alerts you when they appear.
Two breaches, one company
If you had a Zacks account in 2023, you may already have changed your password after the first breach. Check that you did, because HIBP says the 2024 data contains records from the earlier incident plus millions more. People who joined or updated details after 2023 can appear only in the second set.
The unsalted hashes also mean attackers don't need to crack each password one by one: common passwords match across the whole list at once. A long, unique password takes far longer to guess than a short or common one.
What to do if you were in it
- 1
Change your Zacks password and any copies
Set a new, unique password on Zacks and on every other site where you used it. Use a password manager and turn on two-factor login, especially on email and investment accounts.
- 2
Be wary of investment pitches
Calls, texts and emails about stock tips, account problems or 'exclusive research' that use your real name may be scams. Never move money based on an unsolicited message.
- 3
Expect phishing that uses your details
Your name, address and phone number were exposed. Messages that quote them are not proof of a real sender.
- 4
Review your brokerage and bank accounts
Check statements for activity you don't recognise and make sure two-factor login is on at your brokerage.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details have been exposed, and get an alert when they appear in a new breach.
Frequently asked
Was I affected by the 2024 Zacks breach?
HIBP counts 11,994,223 unique email addresses. Check yours on Have I Been Pwned or with a free Serus scan.
What was exposed in the Zacks breach?
HIBP lists email addresses, IP addresses, names, passwords, phone numbers, physical addresses and usernames.
Should I change my password?
Yes. The passwords were unsalted SHA-256 hashes, which are easier to crack. Change your Zacks password and any account that shares it.
Has Zacks confirmed the breach?
Zacks did not respond to HIBP's attempts to contact it about the 2024 incident. It did confirm an earlier breach in 2023, whose data this one includes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
