12 million emails and passwords stolen in Zacks data breach—and users were never notified

Just found out that my email was part of a massive data breach involving Zacks Investment Research, and I was never notified.

According to a memo I received, (would attach but this community doesn’t allow it 🙄) over 12 million email addresses and usernames were stolen and later leaked on BreachForums—11 million of those were linked to hashed passwords. Even worse, other sensitive data like names, phone numbers, IP addresses, and physical addresses were included in the leaked package.

Apparently, this isn’t the first time either. Zacks was hit twice, with the second breach allegedly occurring in June 2024.

What frustrates me the most is that I was never contacted by Zacks. No heads-up, no recommendation to reset my password, not even a confirmation of what password was breached so I could check if it’s still in use anywhere else.

If you’ve ever signed up for Zacks or used their services, check if your data was compromised using tools like HaveIBeenPwned, and consider changing your passwords ASAP.

Zacks owes users transparency, and at the very least, notification.