HackingCustomer Data InvolvedIDENTITY_BASICCREDENTIALSLowContained
Zacks Investment Research, Inc.
bd_04875273dd1e1a1a · schema v1 · pii pii-v1
Full breach record for Zacks Investment Research, Inc. →Zacks Investment Research, Inc. notified the California Attorney General of a data breach affecting customer records from an older database (Zacks Elite product, 1999-2005). Unauthorized access occurred between November 2021 and August 2022, discovered on December 28, 2022. Affected data includes name, address, phone number, email address, and password. No financial or credit card data was accessed. The company implemented additional security measures and forced password resets.
California clockDiscovered Dec 28, 2022 → Notified Feb 3, 202337d ✓ CA 60-day OK6 weeks discovery → filing
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_c8a0857ccde74b8aVermont State AGfiled 2023-02-09Verified
- bd_daa3aa0104e5b9c1Oregon State AGfiled 2023-02-14(5d gap)Verified
- bd_970b99429d0373ebDelaware State AGfiled 2023-02-24(15d gap)Verified
- bd_b08aad0e108dbc71Delaware State AGfiled 2023-02-24(15d gap)Verified
Show 2 more filings ↓Show fewer ↑up to 16d gap
- bd_3836f7bd09ba87faWashington State AGfiled 2023-01-24(16d gap)Candidate
- bd_7139625351e3a112Maine State AGfiled 2023-01-24(16d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-562933
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 9, 2023
- Raw hash
- 1fca83b28527a0325ba171586df79bb890924066a204e2e86efeea402f28873e
Reporting entity
- Name
- Zacks Investment Managementnorm: zacks investment management
- Domain
- zacksim.com
Victim entity
- Name
- Zacks Investment Research, Inc.norm: zacks investment research
- Domain
- zacks.com
Incident
- Discovered
- Dec 28, 2022
- Materiality determined
- —
- Notification sent
- Feb 3, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 37d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 28, 2022→ Notified: Feb 3, 202337d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.