The Zacks Breach Exposed Exactly 8,872,973 Password Hashes

HEROIC analysts confirmed a database breach affecting Zacks, the investment research firm, after stolen data appeared on a hacking forum on June 22, 2024. The leak contains exactly 8,872,973 records, including email addresses, IP addresses, names, usernames, phone numbers, and password hashes, and it overlaps with a separate Zacks breach the company confirmed back in 2023.

Why This Is Dangerous

This leak pairs financial-industry email addresses with enough personal detail, names, phone numbers, IP addresses, and usernames, to let an attacker impersonate Zacks or its users convincingly. The password hashes in this leak use SHA-256 without salting, an older method that is far easier to crack at scale than modern algorithms like bcrypt, meaning a large share of these passwords could be recovered by an attacker with modest computing resources.

What Was Exposed

• Email addresses
• IP addresses
• First and last names
• Usernames
• Phone numbers
• Password hashes (unsalted SHA-256)

Why This Matters

Because this data overlaps with a previous 2023 Zacks incident, some of these nearly 8.9 million people may now have had their information exposed twice. Financial research platforms are valuable targets because their users often reuse the same login across brokerage, banking, and email accounts. A cracked password from this leak, combined with a name and phone number, gives an attacker everything needed for credential stuffing, account takeover, or a convincing phishing call.

How Database Breaches Happen

This incident is classified as a database breach, meaning attackers most likely gained direct access to Zacks' backend systems rather than infecting individual users. Recurring breaches at the same organization often point to an unresolved vulnerability, an unpatched system, weak access controls, or a previously compromised credential that was never fully rotated out. Once inside, exporting millions of user records is a matter of running a single query.

Check If You Are Affected

If you have ever created a Zacks account, checking your exposure takes seconds. HEROIC's free breach scanner searches more than 400 billion leaked records, including this one, so you can find out immediately if your email and password need attention.