Zacks Data Breach (2020): What Was Exposed & What To Do

Breaking down the breach

The facts show that Zacks, an investment research company, announced a data breach in December 2022. Initial reports the following month described an impact on 820,000 customers. In June 2023 a larger set of records covering almost 9 million customers surfaced and began circulating on a hacking forum. The most recent data in that set was dated May 2020 and contained names, usernames, email addresses, physical addresses, phone numbers, and passwords stored as unsalted SHA-256 hashes. On disclosure of the larger set, Zacks stated that unauthorized third parties also gained access beyond the scope of the original report. The exact method and precise timing of the intrusion remain undisclosed in available information.

How a breach like this happens

Incidents involving customer databases at online services often begin with an attacker obtaining access to an internal system through a vulnerability in web applications, weak authentication controls, or compromised credentials belonging to staff or vendors. Once inside, the attacker can locate and copy tables that store user account information. Data may then be held for months or years before appearing on public forums, either through sale or deliberate release. Because many organizations retain older records for operational reasons, a single intrusion can expose information collected over an extended period.

Zacks and its sector

Zacks operates as an investment research firm that provides analysis, stock ratings, and related services to individual and institutional clients. Companies in this sector routinely collect account details, contact information, and authentication data to manage subscriptions and deliver reports. A breach at such a firm is consequential because the records frequently include identifiers that remain stable over time and can be combined with other available information.

What was likely exposed

The published records included the following categories of information:

• Names
• Usernames
• Email addresses
• Physical addresses
• Phone numbers
• Passwords stored as unsalted SHA-256 hashes

Whether additional fields were present is not confirmed in the available reporting.

What's at stake

Individuals whose information appeared in the data set may encounter unsolicited contact attempts or attempts to access other accounts that reuse the same credentials. Organizations holding similar data face regulatory scrutiny and the operational cost of notifying affected users and strengthening controls. Because the passwords were stored without salting, they are more susceptible to offline cracking attempts than modern hashed formats, though the actual success of such attempts depends on password strength and available computing resources.

If your data was in this breach

Begin by changing the password on any Zacks account and on any other service where the same password or a close variation was used. Enable multi-factor authentication wherever available and monitor statements and credit reports for unusual activity. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.