Zacks data breach: what leaked and what to do
Zacks (zacks.com) had a data breach on 2020-05-10 affecting 8,929,503 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 11 June 2023.
What leaked
- Email addresses
- Names
- Passwords
- Phone numbers
- Physical addresses
- Usernames
What happened
In December 2022, the investment research company Zacks announced a data breach. The following month, reports emerged of the incident impacting 820k customers. However, in June 2023, a corpus of data with almost 9M Zacks customers appeared before being broadly circulated on a popular hacking forum. The most recent data was dated May 2020 and included names, usernames, email and physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes. On disclosure of the larger breach, Zacks advised that in addition to their original report "the unauthorised third parties also gained access to encrypted [sic] passwords of zacks.com customers, but only in the encrypted [sic] format".
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Zacks breach?
Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
When did the Zacks breach happen?
The breach date is 2020-05-10; it was added to the public catalogue on 2023-06-10.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.