Zacks zacks.com Zacks data breach: what happened and what to do
Zacks Investment Research announced a breach in December 2022 that affected 820,000 customers. In June 2023 a larger dataset appeared: HIBP counts about 8.9 million accounts with names, addresses, phone numbers and unsalted SHA-256 password hashes.
View all 13,115 breaches- Breach date
- 10 May 2020
- Affected
- 8,929,503
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Zacks Investment Research announced a data breach in December 2022. In early 2023, reports put the number at 820,000 customers. According to BleepingComputer, the data came from an older database of Zacks Elite subscribers.
A bigger dataset
In June 2023, a much larger set of Zacks customer data appeared and spread on a hacking forum. Have I Been Pwned (HIBP) counts 8,929,503 accounts. The most recent records date from May 2020.
What was exposed
The data included names, usernames, email addresses, physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes. An unsalted hash can be cracked in bulk if the password was common or short.
When the larger dataset came out, Zacks said that in addition to its original report, "the unauthorised third parties also gained access to encrypted [sic] passwords of zacks.com customers, but only in the encrypted [sic] format".
What this means for you
Investment account holders are a good target for fraud, so expect phishing that looks like a broker or finance site. Names, addresses and phone numbers together also help with identity fraud.
The company's response
Zacks's breach notice lays out its account of the incident. Reports said it reset passwords for affected accounts.
What to do if you were in it
- 1
Change your password and any copy of it
Change your Zacks password, then change it on every other account where you used the same or a similar one. Zacks passwords were stored as unsalted hashes, so assume a weak one has been cracked. Turn on two-factor login where it's offered, and use a password manager so each account gets its own password.
- 2
Expect phishing that uses real details
With your name, address and phone number in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 3
Watch your financial accounts
Look over brokerage and bank statements for anything you don't recognize, and turn on login alerts where offered.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Zacks breach?
HIBP lists 8,929,503 accounts. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Zacks breach?
Names, usernames, email addresses, physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes.
Why are there two numbers for the Zacks breach?
Zacks first reported 820,000 customers in 2023. A larger dataset of almost 9 million accounts then appeared, and HIBP counts that one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
