HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)CredentialsLowContained

Zacks Investment Research, Inc.

bd_04875273dd1e1a1a · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 28, 2022

Filed

Feb 9, 2023

To disclose

6 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for Zacks Investment Research, Inc. →2 incidents on file

Zacks Investment Research, Inc. notified the California Attorney General of a data breach affecting customer records from an older database (Zacks Elite product, 1999-2005). Unauthorized access occurred between November 2021 and August 2022, discovered on December 28, 2022. Affected data includes name, address, phone number, email address, and password. No financial or credit card data was accessed. The company implemented additional security measures and forced password resets.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 28, 2022 → Notified Feb 3, 202337d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 422 days

discovery → filing · 6 weeks / 43 days

Nov 1, 2021

Begins

Dec 28, 2022

Discovered

Feb 9, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_c8a0857ccde74b8a2023-02-09Verified
Oregon State AGbd_daa3aa0104e5b9c12023-02-14 · +5dVerified
Delaware State AGbd_970b99429d0373eb2023-02-24 · +15dVerified
Washington State AGbd_3836f7bd09ba87fa2023-01-24 · +16dCandidate

Show 1 more filing ↓up to 16d gap

Maine State AGbd_7139625351e3a1122023-01-24 · +16dVerified

Name: Zacks Investment Research, Inc.
norm: zacks investment research
Domain: zacks.com

Name: Zacks Investment Research, Inc.
norm: zacks investment research
Domain: zacks.com
Industry: Financial Servicesllm

Discovered: Dec 28, 2022
Breach occurred: Nov 1, 2021 – Aug 31, 2022
Undetected for: 422 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Implemented additional security measures to our network
Implemented a process so that your Zacks account cannot be accessed with the compromised password
Consulting with outside cybersecurity expert
Conducting an investigation
Continuing ongoing efforts to evaluate and implement additional measures to further enhance our protocols for the protection of your personal information
Changes made: Implemented additional security measures to our network
Implemented a process so that your Zacks account cannot be accessed with the compromised password
Evaluating and implementing additional measures to further enhance our protocols for the protection of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: CA 60-day OK · 37d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 28, 2022
→ Notified: Feb 3, 2023
37d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 28, 2022 → Notified: Feb 3, 2023	37d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGJan 24 · first

Maine State AGJan 24 · first

Vermont State AG+16d

California State AG+16d · this page

Oregon State AG+21d

Delaware State AG+31d

Pattern: first filing Jan 24 (WA), last Feb 24 (DE) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-562933
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2023
Raw hash: 1fca83b28527a0325ba171586df79bb890924066a204e2e86efeea402f28873e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityZacks Investment Research, Inc.

Victim entityZacks Investment Research, Inc.

Incidentdiscovered Dec 28, 2022

Stated responseImplemented additional security measures to our network

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov