Zacks Investment Research, a Chicago-based financial data and analysis firm, suffered a data breach affecting approximately 8.9 million customer records. The breach was first disclosed in December 2022, with Zacks initially reporting that around 820,000 customers were affected by unauthorized access occurring between November 2021 and August 2022. In June 2023, a far larger dataset containing records from nearly 8.8 million Zacks users appeared on a hacking forum. That dataset appeared to originate from a separate, earlier incident, with the most recent records dated May 2020. The attack pathway involved a misconfiguration that allowed direct access to customer data. The exposed data included full names, usernames, email addresses, home addresses, phone numbers, and passwords. The passwords were stored as unsalted SHA-256 hashes, a weak form of protection that makes them relatively easy to crack with modern tools. Zacks described the passwords as "encrypted," but unsalted SHA-256 is not encryption and provides limited security. The combination of contact details and crackable passwords creates serious exposure for affected individuals. No major regulatory action or settlement specific to this breach has been publicly documented. Zacks did acknowledge in later statements that the unauthorized parties had also accessed customer passwords beyond what was initially reported. People whose data was exposed face elevated risks of phishing attacks, investment fraud, and account takeovers, particularly given that Zacks customers are identifiable as active investors, which increases the credibility and targeting precision of financial scams.

Investment research and advisory firms collect subscriber identity, contact details, billing records, newsletter subscriptions, and research-consumption behavior tied to financial analysis services.

Zacks has continued to operate as a financial research platform through a period in which it experienced multiple distinct data security incidents across 2020, 2023, and 2024. The pattern of repeated breaches drew attention from security researchers and media. No major organizational changes beyond the breach response context have been prominently reported.