Cushman & Wakefield data breach: 310K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-05-12
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers. Exposed data: email addresses, job titles, names, phone numbers, physical addresses, salutations. The breach dates from May 5, 2026; Have I Been Pwned loaded it on May 12, 2026.
What to do
- If you had a Cushman & Wakefield account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
