HackingFinancial ServicesTechnologyFinanceStolen CredentialsDelayed DiscoveryCustomer Data InvolvedAuthenticationCredentialsIdentity (basic)MediumContained

Zacks Investment Research, Inc.

bd_3836f7bd09ba87fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 28, 2022

Filed

Jan 24, 2023

To disclose

27 days

Affected

18,815state residents only

Linked

6 filings

Confidence

68%

Full breach record for Zacks Investment Research, Inc. →2 incidents on file

Zacks Investment Research, Inc. notified the Washington AG that an unknown third party gained unauthorized access to an older customer database (1999-2005) between Nov 2021 and Aug 2022. Discovered Dec 28, 2022. Affected 18,815 WA residents with names, addresses, emails, and passwords. No financial data accessed. Notifications sent Jan 27, 2023.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 422 days

discovery → filing · 27 days

Nov 1, 2021

Begins

Dec 28, 2022

Discovered

Jan 24, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_7139625351e3a1122023-01-24Verified
California State AGbd_04875273dd1e1a1a2023-02-09 · +16dVerified
Vermont State AGbd_c8a0857ccde74b8a2023-02-09 · +16dVerified
Oregon State AGbd_daa3aa0104e5b9c12023-02-14 · +21dVerified

Show 1 more filing ↓up to 31d gap

Delaware State AGbd_970b99429d0373eb2023-02-24 · +31dVerified

Name: Burke, Warren, MacKay & Serritella, P.C.
norm: burke warren mackay serritella
Domain: zacks.com

Name: Zacks Investment Research, Inc.
norm: zacks investment research
Domain: zacks.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Dec 28, 2022
Breach occurred: Nov 1, 2021 – Aug 31, 2022
Undetected for: 422 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 27, 2023
Affected individuals: 18,815state-resident count only
Data types: Identity (basic)Credentials
Data elements: NameUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Attorney General Bob Ferguson
Initial access: valid_credentials

During the incident: Took immediate steps to investigate the breach with the assistance of cybersecurity experts
Secured its systems
Implemented a process so that Zacks customers' accounts cannot be accessed with the compromised password
Continuing to implement additional security features to help ensure and increase the security of its systems both internally and externally
Evaluating additional measures to further enhance protocols for the protection of personal information
Changes made: Implemented additional security measures to our network
Process requiring affected users to change their password when they next attempt to access their account
Continuing ongoing efforts to evaluate and implement additional measures to further enhance protocols for the protection of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGJan 24 · first

Washington State AGJan 24 · first · this page

California State AG+16d

Vermont State AG+16d

Oregon State AG+21d

Delaware State AG+31d

Pattern: first filing Jan 24 (ME), last Feb 24 (DE) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19545.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2023
Raw hash: 9e7d75a7ab22d3893761c27d3a5115dd6d458e12273a2ab3079297f8893fd689

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBurke, Warren, MacKay & Serritella, P.C.

Victim entityZacks Investment Research, Inc.

Incidentdiscovered Dec 28, 2022

Stated responseTook immediate steps to investigate the breach with the assistance of cybersecurity experts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com