Privacy Unpacked
Menu

Confirmed breach

Marcus & Millichap data breach

Country being checked · marcusmillichap.com

Marcus & Millichap notified the Washington Attorney General of a data breach on 3 May 2026. It affected 1,837,078 accounts. Exposed: Email addresses, Phone numbers, Names, Addresses, Employers and Job titles. The breach began on 12 April 2026, 21 days before it was reported.

Status
Confirmed breach
People affected
1,837,078 accounts
Reported
3 May 2026
Breach began
12 April 2026
Time to tell
21 days (the median in California’s notices over the last year: 154 days)

What was exposed

  • Email addresses
  • Phone numbers
  • Names
  • Addresses
  • Employers
  • Job titles

Before the notice: the ransomware gang Shinyhunters named Marcus & Millichap on its leak site on 12 April 2026, 21 days before this was reported. Matched by the organisation’s name: the notice itself does not say who the attacker was.

What the letter says

We have not read this letter yet.

Got a letter or email about this breach? Check it is real →

Read the letter (PDF), as filed with the Washington Attorney General.

Sources

Official notices are read by code from the regulator’s own register. Breach databases are read by code. More notices to Washington. · Corrections and changes

If Marcus & Millichap had your data

  1. Look for Marcus & Millichap’s own notice or letter: it should say what of yours was involved. Keep it.
  2. Expect scams that use your details: calls, texts or emails pretending to be Marcus & Millichap, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

One email to confirm first. We use your address only for this alert, and one click deletes it.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.