Marcus & Millichap Hit by ShinyHunters Extortion Campaign, Exposing 1.8M Email Addresses In a recent cybersecurity incident, commercial real estate firm Marcus & Millichap was targeted in a "pay or leak" extortion campaign by the hacking group ShinyHunters last month. The breach compromised 1.8 million unique email addresses, along with associated names, phone numbers, and employment-related information. Approximately 70% of the exposed data was already publicly available on LinkedIn, raising concerns about the overlap between leaked and pre-existing personal information. The incident highlights the risks of data aggregation by third parties, which often use essential and non-essential cookies for service delivery, security, analytics, and targeted advertising practices that can inadvertently expand exposure in breaches. The breach was documented by Have I Been Pwned, a data breach notification service, further confirming the scope of the leak. While the full impact remains under assessment, the incident underscores the growing threat of extortion-based cyberattacks targeting sensitive corporate and personal data.