Marcus & Millichap
Disclosed May 3, 20264 months ago1,837,078 accountsConfirmed
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group . Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice , Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and genera
What is known
| People affected | 1,837,078 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | May 3, 2026 |
| Discovered | Apr 10, 2026 |
| Happened | Apr 7, 2026 |
| Attack | Phishing |
| Data exposed | Emails, Employment, Names, Phone numbers, Addresses |
| Sector | Tech · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Marcus & Millichapatg.wa.gov · Official notice | Official notice |
| Have I Been Pwned: Marcus & Millichaphaveibeenpwned.com · Aggregator | Aggregator |
| Marcus & Millichap disclosuremarcusmillichap.com · The organization | The organization |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | May 3 | 1,837,078 |
| Washington AGresidents of WA | May 14 | 756 |
History of this record
- 2026-09-25 · hibp: empty to MarcusMillichap · backfill source
- 2026-09-25 · sector: other to tech · backfill source
- 2026-09-25 · data_types: [] to ["emails","employment","names","phone","addresses"] · backfill source
- 2026-09-25 · records_basis: empty to hibp · backfill source
- 2026-09-25 · records: empty to 1837078 · backfill source
- 2026-09-25 · disclosed: 2026-05-14 to 2026-05-03 · backfill source
- 2026-09-25 · summary: empty to In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group . Data alleged to have been obtained from the company was subsequently · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.