Zacks Investment Research (Zacks) reportedly suffered another data breach, which compromised sensitive information from about 12 million accounts.
See also: Hackers leaked configs and VPN credentials for 15,000 FortiGate devices
Zacks is a leading American investment research firm, providing its clients with valuable, evidence-based, data-. Through its exclusive "Zacks Rank" tool, which evaluates stock performance, it helps investors make more informed and strategic financial decisions.
In late January, a threat actor posted data samples on hacker forums, claiming that a June 2024 breach occurred at Zacks Investment, which exposed the data of millions of clients.
The published data, which is available to forum members upon payment of a small amount in cryptocurrency, includes full names, usernames, email addresses, physical addresses, and phone numbers.
See also: Cisco confirms second data leak
The attacker revealed to BleepingComputer that he gained domain administrator privileges on the company’s Active Directory. With this access, he was able to steal the source code of the main website (Zacks.com) as well as 16 additional websites, including internal platforms. To prove the successful breach, he shared samples of the stolen source code.
This morning, the Zacks Investment database leak was added to Have I Been Pwned, a popular website where users can check if their personal data has been exposed in security breaches.
The HIBP service confirmed that the file contained 12 million unique email addresses, accompanied by IP addresses, names, passwords in the form of unsalted SHA-256 hashes, phone numbers, physical addresses and usernames.
The service points out, however, that approximately 93% of the leaked email addresses were already registered in its database, coming from previous breaches of either the same platform or other services.
See also: IntelBroker leaked data from Cisco DevHub portal
A data breach is a serious threat to the security of personal information and sensitive data. It occurs when unauthorized individuals gain access to data, either through cyberattacks, human error or security system weaknesses. The consequences can be devastating, including loss of trust, financial losses and legal implications. Therefore, adopting strong security measures and continuous training are crucial to protect against such threats.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
