Zacks Investment Research Breach (2024): 12 Million Customer Records Including Passwords, Phone & Address Exposed :: Second Confirmed Breach

About Zacks

Zacks Investment Research is a Chicago-based financial research and data firm providing investment analysis, stock screening tools, earnings estimate data, and advisory services to retail and institutional investors. The company is private and has operated since 1978 as a provider of proprietary earnings data, analyst ratings, and market intelligence.

Why They Hold Your Data

Investment research and advisory firms collect subscriber identity, contact details, billing records, newsletter subscriptions, and research-consumption behavior tied to financial analysis services.

Recent Developments

Zacks has continued to operate as a financial research platform through a period in which it experienced multiple distinct data security incidents across 2020, 2023, and 2024. The pattern of repeated breaches drew attention from security researchers and media. No major organizational changes beyond the breach response context have been prominently reported.

Data Points Exposed

Breach Impact

In June 2024 a threat actor published to a hacking forum a dataset described as a superset of the prior Zacks breach material, adding approximately 12 million further records and representing cumulative exposure of personal and account data from the company's customer base across multiple incidents. Zacks acknowledged the prior 2023 breach but has not made detailed public statements confirming the 2024 publication as a distinct incident. The pattern of successive, escalating exposures from the same organization drew sustained attention in breach intelligence communities.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Reset any reused passwords and enable MFA on email first, then financial accounts.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).