2026 Marcus & Millichap - ShinyHunters extortion leak; 1.8M unique emails
Data compromised
Email addresses, names, phone numbers, employers, job titles, and physical company addresses
Technical writeup
Have I Been Pwned added Marcus & Millichap on May 3, 2026 after the commercial real estate brokerage was named in a ShinyHunters pay-or-leak extortion campaign. HIBP said data alleged to have been obtained from the company was later released publicly and contained 1.8 million unique email addresses plus names, phone numbers, employer, job title, and physical company address. Marcus & Millichap stated in its disclosure that potentially accessed data appeared limited to company forms, templates, marketing materials, and general contact information.
Root cause
Alleged ShinyHunters extortion campaign and release of company contact data