Zacks Investment Data Breach: How to Stay Safe
-
By Farrukh Mushtaq
Farrukh Mushtaq
See author profileFarrukh Mushtaq, a digital marketer at PureSquare, possesses a keen interest in cybersecurity and enjoys writing about it. With several years of experience in the digital marketing industry, he brings expertise and passion to his work.
-
18 February 2025
-
12 mins read
Cybercriminals exploit security gaps repeatedly—once your data is exposed, it remains vulnerable!
A major data breach has allegedly compromised the personal details of nearly 12 million customers of Zacks Investment, a well-known financial research firm.
According to a post on BreachForums by a hacker named "Jurak," the leaked data includes usernames, emails, passwords, full names, addresses, and phone numbers. The attacker claims to have stolen Zacks' source code and database records.
Discover if Your Most Critical Identifiers Have Been Exposed on the Dark Web
Receive timely alerts and actionable insights with PurePrivacy's Dark Web Monitoring.
The company could suffer strict regulatory scrutiny under global data protection laws if verified. Let's break down what happened, the risks involved, and how to protect your data.
What Happened in the Zacks Investment Data Breach?
On January 24, 2025, a BreachForums user, "Jurak," claimed to have breached Zack Investment on June 2024. The leaked data allegedly includes:
- 12 million unique email addresses
- Usernames, full names, phone numbers, and physical addresses
- Unsalted SHA-256 password hashes, making them susceptible to brute-force attacks
- Source code and databases containing sensitive company data
The attacker allegedly gained domain admin privileges, allowing unauthorized access to Zacks' Active Directory and multiple domains.
What Are the Risks of Exposed Data?
If your information was included in the Zacks breach, you could be at risk for:
- Account Takeover – Stolen credentials can be used to access financial accounts, investment portfolios, and personal data.
- Financial Fraud – Personal details can be exploited for fraudulent transactions or identity theft.
- Phishing & Social Engineering Attacks – Cybercriminals can impersonate Zacks or financial institutions to deceive users into revealing additional sensitive information.
- Regulatory Violations & Legal Risks – Zacks Investment may face scrutiny under financial and data protection regulations, including SEC and GDPR compliance requirements.
What Should You Do If Your Data Was Compromised?
Data breaches put your sensitive information at risk. If you suspect your details were exposed, take immediate action:
- Change Your Passwords & Enable MFA – Update your credentials and activate multi-factor authentication (MFA) on all financial accounts.
- Monitor Your Accounts – Regularly check for suspicious activity in your email, bank, and investment accounts.
- Be Wary of Phishing Attempts – Avoid clicking on unsolicited emails or messages requesting personal data.
How to Minimize Damage in Case of a Data Breach
Once data is exposed, it can be used repeatedly by cybercriminals. Immediate action is crucial!
Cybersecurity tools like dark web monitoring can alert you if your personal information is found on underground marketplaces.
Enable PureVPN's Dark Web Monitoring
Get PureVPN to have total control over your privacy and security. Enable dark web monitoring to receive notifications about data leaks, manage your data privacy on social media platforms, and make sure that your identity stays anonymous. Here's how you can use Dark Web Monitoring and take action before it's too late:
- Install PureVPN on your device or update your existing VPN app.
- Visit the Members Area to get access.
- Go to Dark Web Monitoring from the main menu.
4. Select Add Assets to Monitor.
5. Add your email address, SSN, credit card number, passport number, and phone number.
6. Mention the code sent to your registered number and you’re done.
7. Take the recommended steps if your data is part of a breach.
8. You can mark the breaches as resolved.
Frequently Asked Questions (FAQs)
-
How do I know if my data was part of the Zacks breach?
It can be challenging to determine if your information was compromised, but you can check for suspicious activity in your financial accounts and monitor your email for phishing attempts.
-
Is financial data included in this breach?
No. There's no confirmation that banking or investment account details were exposed.
-
What happened in Zacks' previous breaches?
Zacks suffered two prior breaches in 2022 and 2023, affecting over 21 million customers. These incidents exposed encrypted passwords and other user data.
Secure Your Accounts
This is a commonly known fact that financial institutions and investment firms are primary targets for cyberattacks and malicious actors. Multiple data breaches at Zacks Investment make it clear that there is an urgent need for enhanced encryption, better access controls, and proactive security measures.
