Zacks Breach Exposes Nearly 9 Million Customer Records Including Unsalted Password Hashes
What Happened – In December 2022 Zacks disclosed a data breach affecting its investment‑research platform. In June 2023 a dataset containing 8,929,503 records surfaced on a hacking forum, revealing names, usernames, email and physical addresses, phone numbers, and passwords stored as unsalted SHA‑256 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak credential‑storage controls that a continuous‑control‑assurance program is designed to detect and remediate.
- Demonstrating defensible evidence of proper password‑hashing practices (e.g., salted, iterated algorithms) is a core audit‑readiness artifact across multiple frameworks.
- Ongoing monitoring of credential‑access logs and rapid evidence collection are essential to prove due‑diligence after a breach.
Who Is Affected – Financial‑services firms, investment‑research platforms, and any organization that stores customer‑identifying information and authentication data.
Recommended Actions
- Conduct an immediate review of password‑storage mechanisms; migrate to salted, adaptive hashing (e.g., bcrypt, Argon2).
- Rotate all compromised passwords and enforce multi‑factor authentication for customer accounts.
- Update incident‑response playbooks to include evidence‑preservation steps for credential‑related breaches.
- Capture and retain logs of credential‑access events to satisfy audit‑readiness requirements.
Source: Have I Been Pwned – Zacks breach
Technical Notes
- Data types exposed: email addresses, names, usernames, passwords (unsalted SHA‑256), phone numbers, physical addresses.
- Passwords were stored as unsalted SHA‑256 hashes, a practice that does not meet modern cryptographic standards.
- The most recent compromised data snapshot dates to May 2020.
Source: HIBP breach details