Zacks Investment Research Breach Exposes 12 M Accounts and Unsalted Password Hashes
What Happened — In June 2024, Zacks disclosed that a breach had resulted in the public release of data for 11,994,223 accounts on a hacking forum. The leak contains email addresses, IP addresses, names, usernames, phone numbers, physical addresses, and unsalted SHA‑256 password hashes. This incident follows a 2023 breach that exposed a subset of the same data.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk when credential storage and access‑control processes are insufficiently hardened – a core scenario that continuous control‑assurance programs aim to detect, remediate, and evidence.
- Highlights the need for defensible audit evidence around password hashing standards, MFA enforcement, and real‑time monitoring of credential‑related anomalies.
- Aligns with Verisq’s Access Controls capability, which helps organizations prove that identity protection controls are continuously monitored and documented.
Who Is Affected
- Financial services & investment research firms (FIN_SERV)
- Any organization that stores user credentials and personal contact information
Recommended Actions
- Review and upgrade password storage to salted, adaptive hashing (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all privileged and external accounts.
- Implement continuous monitoring of credential‑related events and retain immutable logs for audit readiness.
- Conduct a post‑incident review to map findings to the relevant control objective (credential protection) and update incident‑response playbooks.
Source: Have I Been Pwned – Zacks 2024 breach
Technical Notes
- Data types exposed: email, IP, name, username, phone, physical address, unsalted SHA‑256 password hashes.
- No specific vulnerability (CVE) disclosed; breach likely stemmed from inadequate credential protection and monitoring.
Source: same as above