Technology
Investment research data breach exposes 12 million customers
If there is one sector that has outdone healthcare in data breaches and ransomware attacks, it is finance.
Security incidents affecting financial institutions are becoming increasingly common, whether they involve banks, fintech companies or investment research firms.
The latest case involves Zacks, an American investment research company. A cybercriminal claimed to have stolen 15 million customer and client records, but a separate investigation later confirmed the actual number to be 12 million.
STAY PROTECTED & INFORMED! GET SECURITY ALERTS & EXPERT TECH TIPS — SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW
Illustration of a hacker at work. (Kurt “CyberGuy” Knutsson)
What you need to know
The Zacks Investment breach first came to light in late January 2025 when a hacker known as “Jurak” claimed on BreachForums that they had gained access to Zacks’ systems as early as June 2024.
According to the hacker, they obtained domain administrator privileges for Zacks’ active directory, a critical network security component, allowing them to steal source code for Zacks.com and 16 other websites, including internal tools, along with user account data. The stolen information was then put up for sale on hacker forums, with samples offered for a small cryptocurrency payment to prove authenticity, as reported by BleepingComputer.
Further investigation confirmed the breach occurred in June 2024, exposing 12 million unique email addresses and other personal data. The fact that the attacker managed to gain domain admin access suggests a highly sophisticated attack, potentially exploiting vulnerabilities in Zacks’ network security.
This is not the first time Zacks has suffered a breach. Previous incidents include a 2022 attack that compromised an older Zacks Elite product database from 1999 to 2005, as noted on Zacks’ own breach disclosure page.
Threat actor’s post on BreachForums. (BleepingComputer)
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
What data got compromised
The Zacks Investment data breach, confirmed by Have I Been Pwned (HIBP), exposed a range of sensitive user information, putting those affected at risk. The leaked data includes email addresses, IP addresses, names, phone numbers, physical addresses, usernames, and unsalted SHA-256 hashed passwords.
This kind of information can be misused for phishing, identity theft, credential stuffing, harassment, SIM swapping and even physical threats. Alarmingly, 93% of the leaked email addresses had already been exposed in previous breaches, making reused passwords an even bigger problem. The use of unsalted SHA-256 hashes — widely considered outdated — only adds to the risk, making it easier for attackers to crack passwords and compromise accounts.
Despite the severity of the breach, Zacks Investment Research has yet to release an official statement as of February 2025. The lack of transparency is troubling, especially considering the scale of the breach and Zacks’ history with security incidents.
WHAT IS ARTIFICIAL INTELLIGENCE (AI)?
A person scrolling on a phone. (Kurt “CyberGuy” Knutsson)
FROM TIKTOK TO TROUBLE: HOW YOUR ONLINE DATA CAN BE WEAPONIZED AGAINST YOU
7 ways you can protect yourself after a data breach like this
1. Beware of phishing attempts and use strong antivirus software: After a data breach, scammers often use the stolen data to craft convincing phishing messages. These can come via email, text or phone calls, pretending to be from trusted companies. Be extra cautious about unsolicited messages with links asking for personal or financial details, even if they reference recent orders or transactions. The best way to safeguard yourself from malicious links is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
2. Invest in identity theft protection: Given the exposure of personal data, such as names, addresses and order details, investing in identity theft protection services can provide an extra layer of security. These services monitor your financial accounts and credit report for any signs of fraudulent activity, alerting you to potential identity theft early on. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.
3. Enable two-factor authentication (2FA) on accounts: Enabling two-factor authentication adds an extra layer of security to your online accounts. Even if hackers get hold of your login credentials, they won’t be able to access your accounts without the second verification step, such as a code sent to your phone or email. This simple step can significantly reduce the risk of unauthorized access to sensitive personal information.
4. Update your passwords: Change passwords for any accounts that may have been affected by the breach, and use unique, strong passwords for each account. Consider using a password manager. Get more details about my best expert-reviewed Password Managers of 2025 here.
5. Remove your personal data from public databases: If your personal data was exposed in this breach, it’s crucial to act quickly to reduce your risk of identity theft and scams. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap — and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.
MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC
Kurt’s key takeaways
The Zacks Investment breach highlights just how real the threat of cyberattacks is for financial institutions. With millions of users affected and personal data exposed, the risks of scams and identity theft are higher than ever. The fact that Zacks hasn’t said much about the breach only adds to the uncertainty for those impacted. As these types of attacks become more common, it’s more important than ever to stay on top of your online security — use unique passwords, keep an eye on your accounts, and stay alert for any signs of suspicious activity.
Should there be stricter regulations for how companies disclose breaches and protect customer data? Let us know by writing us at Cyberguy.com/Contact
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
ChatGPT’s cheapest options now show you ads
ChatGPT users may soon start seeing ads in their chats, as OpenAI announced on Monday that it’s officially beginning to test ads on its AI platform. They’ll appear as labeled “sponsored” links at the bottom of ChatGPT answers, but OpenAI says the ads “do not influence the answers ChatGPT gives you.”
Currently, ads will only show up for users on the free version of ChatGPT or the lowest-cost $8 per month Go plan. Users in the Plus, Pro, Business, Enterprise, and Education plans won’t see any ads, so anyone who wants to avoid them has to pay at least $20 per month for the Plus subscription. There is one loophole — OpenAI notes that users can “opt out of ads in the Free tier in exchange for fewer daily free messages.”
Users on the Go tier can’t opt out of seeing ads, but users on both the Free and Go plans can dismiss ads, share feedback on ads, turn off ad personalization, turn off the option for ads to be based on past chats, and delete their ad data. According to OpenAI, advertisers will only get data on “aggregated ad views and clicks,” not personalized data or content from users’ ChatGPT conversations.
Additionally, not all users and chats will be eligible for ads, including users under 18 and conversations on certain sensitive topics “like health, mental health or politics.” Even adult users on the chatbot’s Free and Go plans might not immediately start seeing ads, since the feature is still in testing.
Technology
AI deepfake romance scam steals woman’s home and life savings
NEWYou can now listen to Fox News articles!
A woman named Abigail believed she was in a romantic relationship with a famous actor. The messages felt real. The voice sounded right. The video looked authentic. And the love felt personal.
By the time her family realized what was happening, more than $81,000 was gone — and so was the paid-off home she planned to retire in.
We spoke with Vivian Ruvalcaba on my “Beyond Connected” podcast about what happened to her mother and how quickly the scam unfolded. What began as online messages quietly escalated into financial ruin and the loss of a family home. Vivian is Abigail’s daughter. She is now her mother’s advocate, investigator, chief advocate and protector.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
FROM FRIENDLY TEXT TO FINANCIAL TRAP: THE NEW SCAM TREND
Vivian Ruvalcaba says a deepfake video made the scam against her mom, Abigail, feel real, using a familiar face and voice to build trust. (Philip Dulian/picture alliance via Getty Images)
How the scam quietly started
The scam did not begin with a phone call or a threat. It began with a message. “Facebook is where it started,” Vivian explained. “She was directly messaged by an individual.” That individual claimed to be Steve Burton, a longtime star of “General Hospital.” Abigail watched the show regularly. She knew his face. She knew his voice.
After a short time, the conversation moved off Facebook. “He then led her to create an account with WhatsApp,” Vivian said. “When I discovered that, and I looked at the messaging, you can see all the manipulation.”
That shift mattered. This is a major red flag I often warn people about. When a scammer moves a conversation from a public platform like Facebook to an encrypted app like WhatsApp, it is usually deliberate and designed to avoid detection.
Grooming through secrecy and isolation
At first, Abigail told no one. “She was very, very secretive,” Vivian said. “She didn’t share any of this with anyone. Not my father. Not me.”
That secrecy was not accidental. “She was being groomed not to share this information,” Vivian explained.
This is a tactic I see over and over again in scams like this. Once a scammer feels they have someone emotionally invested, the next step is to isolate them. They push victims to keep secrets and avoid talking to family, friends or police. When Vivian finally started asking questions, her mother reacted in a way she never had before. “She said, ‘It’s none of your business,’” Vivian said. “That was shocking.”
The deepfake video that changed everything
When Vivian threatened to go to the police, her mother finally revealed what had been happening. “That’s when she showed me the AI video,” Vivian said. In the clip, a man who looked and sounded like Steve Burton spoke directly to Abigail and referred to her as “Abigail, my queen.” The message felt personal. It used her name and promised love and reassurance.
“It wasn’t grainy,” Vivian said. “To the naked eye, you couldn’t tell.” Still, Vivian sensed something was off. “I looked at it, and I knew right away,” she said. “Mom, this is not real. This is AI.”
Her mother disagreed and argued back. She pointed to the face and the voice. She also believed the phone calls proved it. That is what makes deepfakes so dangerous. When a video looks and sounds real, it can override common sense and even years of trust within a family.
From gift cards to life savings
The money flowed slowly at first. A $500 gift card request raised the first alarm. Then, money orders and Zelle payments. What Vivian discovered next still haunts her. “She pulled out a sandwich baggie,” Vivian said. “About 110 gift cards ranging from $25 up to $500.” Those cards were purchased with credit cards. Cash was mailed. Bitcoin was sent. In total, the Los Angeles Police Department (LAPD) tallied the losses at $81,000. And the scam was not finished.
The scam against Abigail moved from social media to encrypted messaging, a common tactic used to avoid detection. (Kurt “CyberGuy” Knutsson)
When the scammer took her home
After draining Abigail’s available cash, the scam did not stop. It escalated again. The scammer began pushing her to sell the one asset she still had: her home. “He was pressing her to sell,” Vivian told me. “Because he wanted more money.” The pressure came wrapped in romance. The scammer told Abigail they would buy a beach house together and start a new life. In her mind, this was not a scam. It was a plan for the future. That belief set off a chain reaction.
How the home sale happened so quickly
Abigail sold her condo for $350,000, even though similar homes in the area were worth closer to $550,000 at the time. The sale happened quickly. There was no family involvement. Her husband was still living in the home, yet he did not sign the documents. “She just gave away about $200,000 in equity,” Vivian said. “They stole it.”
What makes this even more troubling is who bought the property. According to Vivian, the buyer was a wholesale real estate company that moved fast and asked very few questions. Messages later reviewed by the family show Abigail actively trying to hide the sale from her husband. In one text exchange, she warned the buyer not to park in the driveway because her husband had access to a Ring camera. That alone should have raised concerns. Instead, the buyers went along with it. “They appeased whatever she asked for,” Vivian said. “They were getting a property she was basically giving away.”
These buyers were not the original scammers, but they benefited from the pressure the scammer created. The scammer pushed Abigail to sell. The buyers took advantage of the situation and the deeply discounted price. The home was not extra money, it was Abigail’s retirement. It was the only real security she and her husband had after decades of work. By the time Vivian uncovered the sale, Abigail was days away from sending another $70,000 from the proceeds to the scammer. Had that transfer gone through, nearly everything would have been gone.
This is the part of the story people struggle to process. Modern AI-driven scams are no longer limited to draining bank accounts or gift cards. They now push victims into selling real property, often with opportunistic players waiting on the other side of the deal.
Why police and lawyers could not stop the damage
Vivian contacted the police the same day she realized her mother was being scammed. “They assigned an investigator,” she told me. “He was already very aware of the situation and how little they can help.” That reality is difficult for families to hear, but it is common.
Many large-scale scams operate overseas. The money moves quickly through gift cards, wire transfers and crypto. By the time victims realize what is happening, the trail is often cold. “Most of these scammers are out of the country,” Vivian said. “No one is being held accountable.”
When the case shifted from criminal to civil
Law enforcement documented the losses and opened a case, but there was little they could do to recover the money or stop what had already happened. The deeper damage came from the home sale, which fell into a legal gray area far beyond a typical fraud report. Once the condo was sold, the situation shifted from a criminal scam to a complex civil fight.
Vivian immediately began searching for legal help. The first attorneys she contacted discouraged her. One told her it could cost more than $150,000 to pursue a case. Another failed to act even after being told about Abigail’s mental illness and history of bipolar disorder. At one point, an eviction attorney testified in court that Vivian never mentioned the romance scam, something she strongly disputes.
By March, Abigail and her husband were forced out of their home. By October, they were fully evicted and locked out. Both parents are now displaced. Abigail is living with family out of state. Her husband, now in his mid-70s, is still working because the home was his retirement.
It was only after reaching out through personal connections that Vivian found an attorney willing to fight. That attorney is now pursuing the case on a contingency basis, meaning the family does not pay unless there is a recovery. The legal argument centers on Abigail’s mental capacity and whether she could legally understand and execute a home sale under the circumstances. The buyers dispute that claim. The outcome will be decided in court.
This is why stories like this rarely end with a police arrest or quick resolution. Once a scam crosses into real estate and civil law, families are often left to navigate an expensive and exhausting legal system on their own. And by then, the damage has already been done.
Why shame keeps scams hidden
Many victims never report scams. Only about 22% contact the FBI. Fewer than 30% reach out to their local police department. Vivian understands why that happens. “She’s ashamed,” Vivian said. “I know she is.” That shame protects scammers. Silence gives them room to move on and target the next victim.
INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU
What started as online messages escalated into gift cards, lost savings and the sale of a family home. (Kurt “CyberGuy” Knutsson)
Red flags families cannot ignore
This case reveals warning signs every family needs to recognize early.
Red flags to watch for
- Sudden secrecy about finances or online activity
- Requests for gift cards, cash or crypto
- Pressure to move conversations to encrypted apps
- AI videos or voice messages used as proof of identity
- Emotional manipulation tied to urgency or romance
- Requests to sell property or move large assets
I want to be very clear about this. It does not matter how smart you are or how careful you think you are. You can become a victim and not realize it until it is too late.
Tips to stay safe and protect your family
These lessons come from both Vivian’s experience and the patterns I see repeatedly in modern scams. Some are emotional. Others are technical. Together, they can help families spot trouble sooner and limit the damage when something feels off.
1) Watch for platform changes
Moving a conversation from Facebook to WhatsApp or another encrypted app is not harmless. Scammers do this to avoid moderation and make messages harder to trace or flag.
2) Question AI proof
Deepfake videos and cloned voices can look and sound convincing. Never treat a video or voice message as proof of identity, especially when money or property is involved.
3) Slow down major financial decisions
Scammers create urgency on purpose. Any request involving large sums, property sales or retirement assets should pause until a trusted third party reviews it.
4) Never send gift cards, cash or crypto
Legitimate people do not ask for payment through gift cards or cryptocurrency. These methods are a common scam tactic because they are hard to trace and nearly impossible to recover.
5) Talk openly as a family
Silence helps scammers. Regular conversations about finances, online contacts and unusual requests make it easier to spot problems early and step in without shame.
6) Reduce online exposure with a data removal service
Scammers research their targets using public databases. They pull names, phone numbers, relatives and property records. Removing that data reduces how easily criminals can build a profile.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
7) Use strong antivirus protection
Malware links can expose financial accounts without obvious signs. Good antivirus software can block malicious links before they lead to deeper access or data theft.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
8) Protect assets early
Living trusts and proper estate planning add protection before a crisis hits. They can help prevent rushed property sales and limit who can legally move assets without oversight.
9) Use conservatorship when capacity is limited
“Conservatorship is the only way,” Vivian said. “Power of attorney may not be enough.” When a loved one has diminished capacity, a conservatorship adds court oversight and can stop unauthorized financial decisions before serious damage occurs.
Kurt’s key takeaways
This scam did not rely on sloppy emails or obvious mistakes. It used emotion, familiarity and AI that looked real. Once trust was built, the damage followed quickly. Money disappeared. Secrecy grew. Pressure increased. The home was sold. What makes this case especially painful is the speed. A few messages led to gift cards. Gift cards turned into life savings. Life savings became the loss of a home built over decades. Most families never expect this to happen. Many do not talk about it until it has already happened. The lesson is clear. Awareness matters more than intelligence. Open conversations matter more than embarrassment. Acting early matters more than trying to undo the damage later. If you want to hear Vivian tell this story in her own words and understand how fast these scams unfold, listen to our full conversation on the “Beyond Connected” podcast.
If a deepfake video showed up on your parent’s phone tonight, would you know before everything was gone? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
MrBeast just bought a banking app
Beast Industries, owned by YouTuber Jimmy “MrBeast” Donaldson, announced on Monday that it has acquired Step, a banking app designed for teens and young adults. The move comes a couple of months after Donaldson announced plans to start a new YouTube channel centered on personal finance and investing. His main channel has 466 million subscribers and has long been one of the most popular on YouTube, frequently featuring videos where Donaldson gives away huge sums of money.
MrBeast’s other business ventures also include a chain of ghost restaurants, the Feastables snack brand, and an upcoming phone service company called Beast Mobile. This is his company’s first dip into financial services.
Step is one of many mobile-only banking services, similar to Monzo or Revolut, but specifically aimed at teens, which may explain why Donaldson chose it over its rivals — his audience is mainly Gen-Z and Gen Alpha. Step’s investors also include Gen-Z influencers Josh Richards and Charli D’Amelio, the latter of whom has appeared on MrBeast’s YouTube channel.
-
Indiana1 week ago13-year-old rider dies following incident at northwest Indiana BMX park
-
Massachusetts1 week agoTV star fisherman, crew all presumed dead after boat sinks off Massachusetts coast
-
Tennessee1 week agoUPDATE: Ohio woman charged in shooting death of West TN deputy
-
Politics5 days agoWhite House says murder rate plummeted to lowest level since 1900 under Trump administration
-
Indiana1 week ago13-year-old boy dies in BMX accident, officials, Steel Wheels BMX says
-
Politics7 days agoTrump unveils new rendering of sprawling White House ballroom project
-
Alabama3 days agoGeneva’s Kiera Howell, 16, auditions for ‘American Idol’ season 24
-
San Francisco, CA6 days agoExclusive | Super Bowl 2026: Guide to the hottest events, concerts and parties happening in San Francisco