Shinyhunters claims to have stolen Salesforce records from Marcus & Millichap, Inc.

• Ransomware group: Shinyhunters
• Country: United States
• Sector: Financial Services
• Announcement date: April 12, 2026

The threat actor known as Shinyhunters has published a leak announcement targeting Marcus & Millichap, Inc. The group claims to have successfully compromised a significant amount of data belonging to the organization, specifically targeting records within their Salesforce database.

The alleged attack and ransom demand

According to the announcement published on a leak site, the threat actor known as Shinyhunters claims to have targeted Marcus & Millichap, Inc. on April 11, 2026. The group asserts that they have obtained over 30 million records from the organization's Salesforce database during this incident.

Following the alleged theft, the group has issued a ransom demand. The threat actor is demanding a payment by April 14, 2026, to prevent the public release of the stolen information. The group has further threatened that failure to meet their demands could result in additional digital disruptions for the organization.

Data involved in the claim

While the group has made these significant claims, no screenshots have been provided to verify the contents of the alleged breach. The information provided by the threat actor suggests that the leaked data contains sensitive information that could impact various stakeholders. The data said to be involved includes:

• Personally identifiable information (PII)
• Internal corporate data

No specific details regarding the exact file count or the total size of the data were provided in the announcement.

About Marcus & Millichap, Inc.

Marcus & Millichap is a multinational company providing commercial real estate investment services, brokerage, financing, and research. The company offers professional solutions to investors regarding real estate transactions and financial advisory.

Risk assessment and industry implications

This claim poses a potential risk to the privacy of the organization's customer and employee data. Because Marcus & Millichap, Inc. is a United States-based entity, a potential data breach of this nature could lead to legal consequences under both state laws and federal regulations. The nature of the alleged data, particularly the inclusion of personally identifiable information, could facilitate identity theft and targeted phishing attacks against the affected individuals.

Furthermore, the organization may face operational disruptions and significant reputational damage resulting from the incident. The threat actor appears to be employing a double-extortion tactic, a method where attackers not only encrypt or steal data but also threaten to leak it to increase the pressure on the victim to pay the ransom.

In the financial services sector, organizations often face such threats due to the high value of the data they manage. To defend against these types of attacks, organizations typically implement multi-factor authentication, maintain strict access controls for cloud-based platforms like Salesforce, and conduct regular security audits. Information regarding the specific capabilities and history of the Shinyhunters group remains limited.