Zack Investment Data Breach Impacts Millions of Users

Researchers have discovered a breach at Zacks Investment Research dating all the way back to 2020, which has impacted millions of customers.

No public disclosure about the incident has been done. But, a post on breach site HaveIBeenPwned revealed that a trove of data numbering nearly nine million customers is being widely shared on a popular hacking forum.

The most recent data was dated May 2020 and included names, usernames, email and physical addresses, phone numbers, and passwords stored as unsalted SHA-256 hashes. The disclosure of the data means that customers should expect follow-on phishing and other attacks.

In January, the firm revealed a breach of data on an estimated 820,000 customers, which it said occurred sometime between November 2021 and August 2022.

This particular incident involved a legacy database of customers who signed up for the Zacks Elite product between November 1999 and February 2005, the firm said at the time.

As per the official statement, We have no reason to believe any customer credit card information, any other customer financial information, or any other customer personal information accessed.

Customers will no doubt be concerned at not only the size of the newly disclosed breach but also the fact that it remained undetected for so long.