Marcus & Millichap data breach: what happened and what to do

What happened

Marcus & Millichap is a US commercial real estate brokerage. In April 2026 it was named as one of several alleged victims of the ShinyHunters hacking and extortion group, according to Have I Been Pwned (HIBP). Data said to come from the company was then released publicly. SC Media covered the group's wider campaign.

HIBP dates the incident to 12 April 2026 and added it on 3 May 2026. It counted 1,837,078 accounts, with about 1.8 million unique email addresses.

The company published a press release on its website on 12 April 2026. It said it had found unauthorized access to one system, caused by a phishing attack on an employee's credentials. It said it brought in outside cybersecurity experts to contain the activity and that its operations had not been disrupted.

What was exposed

HIBP lists:

• Email addresses
• Names
• Phone numbers
• Employers
• Job titles
• Physical addresses (company addresses)

The company's first notice said the data that may have been accessed appeared limited to company forms, templates, marketing materials and general contact information. A later FAQ from the company described the data more widely, including contact details for employees, independent contractor agents and clients, certain property transaction information and dates of birth. Read the company's FAQ for the current wording, since it was updated after the first notice.

What this lets criminals do

Contact data tied to commercial real estate is useful to scammers because deals involve large sums and wire transfers. Someone who knows your name, email, employer and role can write a message that looks like it came from a broker, an investor or a lender.

The scam to watch is business email compromise. A fraudster poses as a party to a deal and says bank details for a payment have changed. If you work in commercial real estate, confirm any change to wire instructions by calling a number you already have.

For everyone else in the data, the risk is phishing and targeted spam. A message that mentions your employer or your job title is more likely to get a click.

The company's response

Marcus & Millichap said it activated its incident response protocols, hired outside experts and notified law enforcement. It said it would cooperate fully with authorities. The company also said it had cyber insurance that it expected to cover most costs of the incident.

What to do

Don't treat the contact details as secret anymore. Verify any request involving money, and be cautious about messages that mention a deal or listing you didn't initiate. If you are a client or agent, watch for notices from the company, and read them on the company's own site.