Zacks (2024) data breach: what leaked and what to do
Zacks (2024) (zacks.com) had a data breach on 2024-06-22 affecting 11,994,223 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 13 Feb 2025.
What leaked
- Email addresses
- IP addresses
- Names
- Passwords
- Phone numbers
- Physical addresses
- Usernames
What happened
In June 2024, the investment research company Zacks was allegedly breached, and data was later published to a popular hacking forum. This comes after a separate Zacks data breach confirmed by the organisation in 2023 with the subsequent breach disclosing millions of additional records representing a superset of data from the first incident. The 2024 breach included 12M unique email addresses along with IP and physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes. Zacks did not respond to multiple attempts to contact them about the incident.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Zacks (2024) breach?
Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
When did the Zacks (2024) breach happen?
The breach date is 2024-06-22; it was added to the public catalogue on 2025-02-12.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.