8 Million Accounts Compromised in Latest Zacks Data Breach, Warns Have I Been Pwned

IT Services provider Zacks Investment Research (Zacks) has experienced an older, previously undisclosed data breach that has affected 8.8 million customers, with the database now being shared on a hacking forum.

A data breach was previously disclosed by Zacks, which occurred between November 2021 and August 2022. The firm warned that unauthorized network intruders accessed the personal and sensitive information of around 820,000 customers.

At that time, Zacks stated in their notification that they had no reason to believe that any customer credit card information, any other customer financial information, or any other customer personal information was accessed.

However, data breach notification service Have I Been Pwned (HIBP) listed an additional Zacks breach this weekend after being sent a database containing 8.8 million user records.

Troy Hunt, the creator of HIBP, told IT Services that this database appears to have been dumped around May 10th, 2020, before the previous breach at Zacks.

Hunt also informed IT Services that the database contains Zacks customers’ email addresses, usernames, unsalted SHA256 passwords, addresses, phone numbers, first and last names, and other data.

It is important to note that financial information like credit card and bank account details are not included in the dump, and it does not appear that the hackers accessed this type of data.

Unfortunately, Zacks had previously initiated a password reset procedure for the breach disclosed in January. However, it can be assumed that the remaining 90% of breached accounts that were not identified as such were not included in the measure, leaving them exposed to account hijacking, credential stuffing, and SIM swapping.

While Zacks did not respond to questions from IT Services, Hunt informed us that Zacks plans on notifying impacted users. However, there is no timeline for when this will be done.

Users of Have I Been Pwned can now enter their email address on the site and be notified if it was found in the newly leaked Zacks data.

What Actions Should Be Taken in Response to the Capita Data Breach?

In response to the recent Capita data breach, immediate actions must be taken to address the alarming situation of data theft by hackers. First, assessing the extent of the breach and identifying affected individuals is crucial for prompt communication and damage control. Secondly, tightening cybersecurity measures and implementing robust encryption protocols can help prevent future data breaches. Lastly, cooperating with law enforcement agencies for thorough investigations and holding the responsible hackers accountable is paramount to ensure justice and deter similar incidents in the future.

Zacks data shared on hacking forum

Soon after adding the data breach to Have I Been Pwned, the Zacks database was posted on the Exposed hacking forum. This site is used to share and sell stolen data.

Exposed is a recently-emerged new hacking forum that gained notoriety after leaking a database containing the details of almost half a million members of the now-defunct RaidForums.

Now that the database has been publicly leaked, threat actors will likely abuse it in phishing or credential-stuffing attacks.

Therefore, all Zacks users are strongly advised to change their passwords to unique ones that are only used at that site.

If you use the same Zacks password at other sites, you should change the passwords at those sites to a unique one as well.