Zacks Investment Research user data breached, hacker leaks info of 12 million users
Learn More
Zacks Investment Research, an American investment research company, has reportedly experienced another significant data breach affecting approximately 12 million user accounts. In late January 2025 a threat actor published data samples on a hacker forum, claiming the breach occurred in June 2024.
The exposed data includes:
- Full names
- Usernames
- Email addresses (12 million unique addresses)
- Physical addresses
- Phone numbers
- Passwords (in unsalted SHA-256 hash format)
- IP addresses
According to the threat actor, they gained domain admin access to the company's active directory and successfully exfiltrated the source code for the main Zacks.com website and 16 additional websites, including internal ones.
Have I Been Pwned (HIBP) has verified and added the leaked database to their service, noting that approximately 93% of the exposed email addresses were already present in their database from previous breaches.
This incident appears to be the third major data breach for Zacks in the past four years:
- May 2020: 8.8 million users affected (verified by HIBP)
- November 2021-August 2022: 820,000 customers impacted (disclosed by Zacks in January 2023)
