Almeida Law Group is investigating a data breach at Cushman & Wakefield. The breach occurred on April 21st, 2026. If you were affected, contact Almeida Law Group.
About Cushman & Wakefield
Cushman & Wakefield is a global commercial real estate services firm headquartered in Chicago, Illinois. The company offers property management, leasing, capital markets, facilities services, project and development services, valuation, and advisory services, operating from approximately 400 offices across 60 countries with around 52,000 employees. Because of its size and the breadth of clients it serves, the firm maintains personal data on a large number of individuals, making a breach of its systems a significant concern for those whose information was stored there.
What Happened?
Cushman & Wakefield was listed in a California Attorney General sample breach notice filed on August 7th, 2026. According to the notice, the company became aware on April 29th, 2026 that an unauthorized third party had gained access to its systems and exfiltrated certain files. The company conducted a comprehensive review of the affected data to identify which individuals were impacted. The notice states that the affected information includes names and at least one additional data field, which appears as a redacted placeholder in the sample letter. Cushman & Wakefield stated it has seen no indication that the information was actually viewed by the unauthorized party or that it has been misused. The company is offering 24 months of Experian IdentityWorks credit monitoring to affected individuals.
The incident has a broader documented history. In early May 2026, Cushman & Wakefield publicly confirmed a data security incident caused by vishing, a form of social engineering in which an employee was manipulated into providing system access. The threat actor group ShinyHunters claimed responsibility and ran a pay-or-leak extortion campaign; Cushman & Wakefield stated it did not engage with the hackers, and ShinyHunters subsequently published the stolen data. Have I Been Pwned indexed the breach on May 12th, 2026, recording approximately 310,431 affected accounts, with the publicly leaked data described primarily as business contact information including names, email addresses, job titles, and phone numbers. ShinyHunters also separately claimed to have stolen more than 500,000 Salesforce records. The ransomware group Qilin independently listed Cushman & Wakefield on its leak site on May 4th, 2026; public reporting suggests dual targeting or coincident timing rather than a confirmed partnership between the two groups. A proposed class action lawsuit filed by commercial tenant Michelle Milewski in the U.S. District Court for the Southern District of New York on approximately May 8th, 2026 alleged that names, Social Security numbers, dates of birth, driver’s license numbers, and financial information were exposed — though these more sensitive categories are litigation allegations and have not been independently confirmed by the company or a regulator. Cushman & Wakefield called the lawsuit “baseless” and described the incident as “very limited in scope.” The plaintiff voluntarily dismissed the case without prejudice in early June 2026, meaning it could be refiled. Law firm Migliaccio & Rathod LLP has also announced a separate investigation into the breach.
Key Facts at a Glance
- Company or Organization: Cushman & Wakefield
- Industry: Commercial real estate services
- Location: Chicago, Illinois (global operations in 60 countries)
- Incident type: Unauthorized access and data exfiltration; vishing (social engineering) attack vector
- Date of breach: April 21st, 2026
- Date breach discovered: April 29th, 2026
- Date of consumer notification: August 7th, 2026
- Identity theft protection offered: 24 months of Experian IdentityWorks credit monitoring
- Prior breach: None identified
- Litigation status: Milewski v. Cushman & Wakefield class action (SDNY) voluntarily dismissed without prejudice in early June 2026; Migliaccio & Rathod LLP investigation ongoing; new litigation possible following August 2026 notification round
- Source: California Attorney General sample breach notice; Have I Been Pwned; CyberPress; The Real Deal
What Should You Do?
If you received a notice from Cushman & Wakefield, enroll in the 24 months of Experian IdentityWorks credit monitoring the company is offering and do so before any stated enrollment deadline. Beyond that, consider placing a fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. Monitor your existing financial accounts closely for unfamiliar transactions and request your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. If you suspect your information has already been misused, visit IdentityTheft.gov for step-by-step guidance on reporting identity theft and recovering from it.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
