Zacks Investment Research (Zacks) has reportedly suffered an old undisclosed data breach affecting 8.8 million clients, with the database now being shared on a hacking forum.
The company disclosed a data breach that occurred between November 2021 and August 2022, warning that unauthorized network intruders had gained access to the personal and sensitive information of approximately 820,000 customers.
“We have no reason to believe that any customer credit card information , any other customer financial information, or any other personal customer information was accessed ,” Zacks said in a statement at the time
However, data breach notification service Have I Been Pwned (HIBP) reported an additional Zacks breach this weekend, after they were sent a database containing 8.8 million user records.
HIBP creator Troy Hunt told BleepingComputer that this database appears to have been dumped around May 10, 2020, before the previous Zacks breach
Hunt told BleepingComputer that the database contains Zacks clients' email addresses, usernames, unsalted SHA256 passwords, addresses, phone numbers, first and last names, and other data.
Financial information, such as credit card and bank account details, is not included in the dump and it does not appear that the hackers had access to this type of data.
Unfortunately, Zack had previously initiated a password for the breach that was revealed in January; however, it can be assumed that the remaining 90% of compromised accounts that were not identified as such were not included in this measure, leaving them exposed to account hijacking, credential stuffing , and SIM swapping.
Have I Been Pwned users can now enter email on the site and be notified if it is found in the data recently leaked by Zacks.
Zacks data shared on hacking forum
Shortly after the data breach was added to Have I Been Pwned, the Zacks database was posted on the hacking forum Exposed – a website used to exchange and sell stolen data.
Exposed is a new hacking forum that recently emerged and gained notoriety after a database containing the details of nearly half a million members of the now-defunct RaidForums was leaked.
Now that the database has been publicly leaked, threat actors will likely abuse it in phishing or credential-stuffing.
Therefore, it is recommended that all Zacks users change their passwords to unique ones that are used only on that particular website.
If you use the same Zacks password on other websites, you should also change the passwords on those websites to a unique one.
Information source: bleepingcomputer.com
