HackingFinancial ServicesTechnologyFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)CredentialsHighContained

Zacks Investment Research, Inc.

bd_7139625351e3a112 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 28, 2022

Filed

Jan 24, 2023

To disclose

27 days

Affected · nationwide

820,0003,134 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Zacks Investment Research, Inc. →2 incidents on file

Zacks Investment Research, Inc. reported an external system breach (hacking) occurring between November 2021 and August 2022, discovered on December 28, 2022. The incident compromised the data of approximately 820,000 individuals, including 3,134 Maine residents. Acquired information included names, addresses, phone numbers, email addresses, and passwords associated with Zacks.com. Written notification was sent to affected consumers on January 27, 2023.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 28, 2022 → Filed with AG Jan 24, 202327d ✓ ME AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 422 days

discovery → filing · 27 days

Nov 1, 2021

Begins

Dec 28, 2022

Discovered

Jan 24, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_3836f7bd09ba87fa2023-01-24Candidate
California State AGbd_04875273dd1e1a1a2023-02-09 · +16dVerified
Vermont State AGbd_c8a0857ccde74b8a2023-02-09 · +16dVerified
Oregon State AGbd_daa3aa0104e5b9c12023-02-14 · +21dVerified

Show 1 more filing ↓up to 31d gap

Delaware State AGbd_970b99429d0373eb2023-02-24 · +31dVerified

Name: Zacks Investment Research, Inc.
norm: zacks investment research
Domain: zacks.com

Name: Zacks Investment Research, Inc.
norm: zacks investment research
Domain: zacks.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Dec 28, 2022
Breach occurred: Nov 1, 2021 – Aug 31, 2022
Undetected for: 422 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 27, 2023
Affected individuals: 820,000state + nationwide
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected consumers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: ME AG ≤30d · 27dME CRA notice due
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 28, 2022
→ Filed with AG: Jan 24, 2023
27d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 28, 2022 → Filed with AG: Jan 24, 2023	27d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Washington State AGJan 24 · first

Maine State AGJan 24 · first · this page

California State AG+16d

Vermont State AG+16d

Oregon State AG+21d

Delaware State AG+31d

Pattern: first filing Jan 24 (WA), last Feb 24 (DE) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/148eb61f-952a-413a-9549-ccc1247252e3.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2023
Raw hash: abb6039312e0d9e5e4535933195d5e7c3d987ed580f1c18e894bf42f54fa7a1f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityZacks Investment Research, Inc.

Victim entityZacks Investment Research, Inc.

Incidentdiscovered Dec 28, 2022

Stated responseSent written notification to affected consumers

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov