ShinyHunters Exposes 1.84 M Records from Marcus & Millichap Commercial Real‑Estate Brokerage
What Happened — In April 2026 the ShinyHunters hacking‑extortion group claimed to have breached Marcus & Millichap, a commercial real‑estate brokerage. The group publicly released roughly 1.8 million unique records containing email addresses, names, phone numbers, employers, job titles and physical addresses.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate identity and access controls over internal contact‑information repositories.
- Continuous monitoring and auditable evidence of privileged‑access reviews are core to a defensible control‑assurance program.
- Demonstrating due‑diligence on data‑handling controls helps satisfy multiple framework requirements (e.g., NIST CSF 2.0, ISO 27001) with a single control objective.
Who Is Affected – Commercial‑real‑estate firms, brokerage agencies, and any third‑party partners that rely on Marcus & Millichap’s contact data.
Recommended Actions
- Conduct an immediate review of who can access client‑contact databases; enforce least‑privilege principles.
- Deploy continuous user‑behavior analytics to detect anomalous access patterns.
- Update incident‑response playbooks to include rapid containment and evidence‑preservation steps for data‑exfiltration events.
- Document all remediation steps to build a defensible audit trail.
Source: Have I Been Pwned – Marcus & Millichap breach
Technical Notes – The breach was attributed to the ShinyHunters group; the exact exploitation technique was not disclosed, suggesting a possible credential‑theft or mis‑configuration vector. Exposed data types: email addresses, names, phone numbers, employer, job title, physical address. Source: same as above