Zacks Investment Research, a Chicago-based financial data and analysis firm, suffered a data breach in 2024 when a threat actor published a dataset on a prominent hacking forum containing records from approximately 12 million customers. The exposure followed a separate breach Zacks confirmed in 2023. The 2024 dataset appears to be a superset of the earlier incident, expanding the cumulative scale of exposed customer data. The attack vector remains unknown, and Zacks did not respond to multiple attempts to contact them about the 2024 publication. The exposed data includes email addresses, names, usernames, passwords, phone numbers, physical addresses, and IP addresses. The passwords were stored as unsalted SHA-256 hashes, a weak protection method that makes them significantly easier to crack than properly secured alternatives. Affected individuals face elevated risk of account takeover, identity theft, and targeted financial fraud. Because Zacks serves retail and institutional investors, their association with the platform can make them more convincing targets for investment scams and impersonation schemes. Zacks publicly acknowledged the 2023 breach but has not issued detailed statements confirming the 2024 forum publication as a distinct incident. No regulatory action or litigation has been publicly confirmed in connection with the 2024 exposure. People whose data was included should treat their Zacks credentials as compromised, change any reused passwords across other accounts, and remain alert to phishing attempts that may reference their investment activity or financial interests.

Investment research and advisory firms collect subscriber identity, contact details, billing records, newsletter subscriptions, and research-consumption behavior tied to financial analysis services.

Zacks has continued to operate as a financial research platform through a period in which it experienced multiple distinct data security incidents across 2020, 2023, and 2024. The pattern of repeated breaches drew attention from security researchers and media. No major organizational changes beyond the breach response context have been prominently reported.