Zacks (2024) Data Breach (2024): What Was Exposed & What To Do

For millions of people who have used Zacks investment research services, the practical stakes of a reported 2024 data incident are immediate and personal. Contact details, account credentials and location information that may have been exposed can be reused for phishing, account takeover attempts or identity-related fraud long after the initial event.

Public reporting places the scale at roughly 12 million people and indicates that the material later appeared on a popular hacking forum. Zacks itself has not publicly confirmed or commented on this specific 2024 incident despite outreach, so affected individuals must treat the available details as claims that still require careful personal verification.

Breaking down the breach

According to reports dated 22 June 2024, the investment research company Zacks was allegedly breached and the resulting data was later published on a popular hacking forum. The material is described as containing 12 million unique email addresses together with IP addresses, physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes.

This 2024 disclosure is presented as a separate event that followed a confirmed Zacks breach in 2023; the newer dataset is characterised as a superset that includes millions of additional records. No further public detail has been released about the precise method of intrusion, the exact window of access, or any forensic findings. Multiple attempts to obtain a response from Zacks about the 2024 incident went unanswered, leaving the organisation’s own assessment of the event undisclosed.

How a breach like this happens

Incidents that result in large customer databases appearing on forums typically begin with one of several common entry points: stolen or reused credentials, unpatched remote-access software, compromised third-party vendors, or misconfigured cloud storage. Once inside a network, attackers often move laterally to locate databases or backup files that contain user profiles, then extract them for later sale or free publication.

Password data is frequently taken in hashed form. When the hashes are unsalted, as reported here, offline cracking becomes significantly easier because identical passwords produce identical hash values and can be attacked with pre-computed tables. Publication on a public forum accelerates the risk because anyone can download the file and begin testing the credentials against other services. No specific threat group has been attributed to this incident, and the exact technical path used remains undisclosed.

About Zacks (2024)

Zacks is an established investment research firm that supplies equity research, rankings, newsletters and portfolio tools to individual investors and financial professionals. Organisations of this type routinely maintain accounts that include login credentials, contact information, physical addresses for mailing materials, and usage logs that can include IP addresses.

A breach affecting such a company is consequential because the data combines identity elements with financial-interest signals. Investors who rely on Zacks for research may reuse the same email and password combinations on brokerage or banking sites, raising the possibility of credential-stuffing attacks against higher-value accounts. The firm’s scale—evidenced by the reported 12 million unique email addresses—means any exposure reaches a large retail-investor population.

The information in question

The data types named in public reporting for the 2024 incident are email addresses, IP addresses, names, passwords (specifically unsalted SHA-256 hashes), phone numbers, physical addresses and usernames. These categories match the kinds of records an investment-research platform would normally hold for account management, communication and service delivery.

Exact file contents, field completeness and whether every record contained every data type remain unconfirmed beyond the published claims. Organisations in this sector typically also store subscription preferences, research-viewing history or payment-related identifiers, but no such additional fields have been verified for this particular dataset. Readers should therefore treat only the listed categories as the currently reported exposure.

Why it matters

For individuals, the combination of email, password hash, name, phone number and physical address creates a ready-made package for targeted phishing, SIM-swap attempts or social-engineering calls that reference real personal details. Unsalted SHA-256 hashes can be cracked offline; once a password is recovered it can be tested against other sites where the same credentials were reused. Physical addresses raise the additional possibility of mail-based fraud or physical-world social engineering.

For the organisation, the incident carries reputational and regulatory consequences, especially given the earlier 2023 breach and the lack of public response to the 2024 claims. Customers may lose confidence in the security of research accounts, and any subsequent identity-fraud cases linked to the data could generate further scrutiny. Because the dataset is already described as published, containment is no longer possible; mitigation now rests with the people whose records appear in it.

What to do if you're exposed

If you have ever held a Zacks account or received communications from the firm, treat the reported exposure as a prompt for immediate hygiene rather than waiting for official confirmation. Practical first steps include:

• Change the password on any Zacks-related account and on every other service where you used the same or a similar password.
• Enable multi-factor authentication wherever it is offered, preferably with an authenticator app or hardware key rather than SMS alone.
• Monitor bank, brokerage and email accounts for unexpected login alerts or password-reset messages.
• Be sceptical of unsolicited calls, texts or emails that reference your name, address or investment interests; verify any request through official channels you initiate yourself.
• Consider placing a fraud alert or credit freeze with the major credit bureaus if you believe your physical address and other identifiers are involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Doing so gives a concrete starting point for deciding which accounts need the most urgent attention.

AICompiled with AI assistance from public sources and published under our editorial standards.