Marcus & Millichap Data Breach April 2026 - What Was Exposed and What To Do

What Happened

In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice, Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and general contact information".

Breach date

2026-04-12

Records affected

1,837,078

Verified

Yes

Domain

marcusmillichap.com

What Was Exposed

The following data types were included in the breach:

• Email addresses
• Employers
• Job titles
• Names
• Phone numbers
• Physical addresses

What You Should Do

If you had an account with Marcus & Millichap, take these steps immediately:

1. Check if your account was affected at HaveIBeenPwned.com
2. Watch for phishing emails that reference the breach or impersonate the affected company
3. Be alert for social engineering attempts using your exposed personal information
4. Enable two-factor authentication on the affected service if available
5. Consider using a password manager to generate unique passwords for each service

FAQ