Marcus & Millichap Releases Information Regarding Cybersecurity Incident

Calabasas, CA., April 12, 2026 - We recently identified unauthorized access to one of our systems through a phishing attack targeting an employee’s credentials. We immediately activated our incident response protocols with the assistance of outside cybersecurity experts to contain the activity. Based on our investigation to date, the data that may have been accessed appears limited to company forms, templates, marketing materials, and general contact information. Our systems and operations continue to run normally with no indication of disruption. We take this matter seriously, and our investigation and response remain ongoing in accordance with our incident response procedures.

Updated April 24, 2026: The Company has notified law enforcement and will cooperate fully. We remain committed to maintaining strong safeguards across our systems.

Updated: May 11, 2026: Cybersecurity Incident: Frequently Asked Questions

1. What happened? 
Marcus & Millichap experienced a cybersecurity incident in which an unauthorized third party used social engineering techniques to obtain a single employee’s login credentials and access certain Company systems. Upon discovering the intrusion, we immediately activated our incident response protocols and engaged outside cybersecurity experts. No other portions of our network environment were impacted, and we experienced no disruption to operations or business continuity. The incident was identified and contained within one hour, and all affected systems have been secured with additional security measures. 

2. What data was involved? 
Based on our investigation to date, the accessed data included: (i) contact information — e.g. names, email addresses, and phone numbers — for employees, independent contractor agents, and clients; (ii) certain property transaction information; (iii) dates of birth for employees and independent contractor agents; and (iv) certain non-sensitive company materials, including templates, forms, and reports from SharePoint. Our investigation to date has found no indication that financial account numbers, Social Security numbers, or similar personal data were accessed. 

3. Was my personal financial information exposed? 
No. Our investigation has found no indication that Social Security numbers, driver’s license numbers, passport information, or similar government-issued identification data were accessed. 

4. What steps did Marcus & Millichap take in response? 
We immediately contained the incident and engaged outside cybersecurity professionals working alongside our internal teams.  We have taken additional steps to strengthen our security controls and safeguards. We notified law enforcement and will cooperate with any investigation.  

5. Was the data released? 
Yes. The threat actor released the accessed data. Based on our investigation, the released data is consistent with what is described in Question 2 above. 

6. Do I need to take any action to protect myself? 
As a general precaution, we encourage everyone to remain alert to unsolicited emails or calls, avoid sharing personal information in response to unexpected outreach, and report anything suspicious to appropriate authorities. 

#     #     #

About Marcus & Millichap, Inc. (NYSE: MMI)

Marcus & Millichap, Inc. is a leading brokerage firm specializing in commercial real estate investment sales, financing, research and advisory services with offices throughout the United States and Canada. As of December 31, 2025, the company had 1,808 investment sales and financing professionals in over 80 offices who provide investment brokerage and financing services to sellers and buyers of commercial real estate. The company also offers market research, consulting and advisory services to clients. Marcus & Millichap closed 8,818 transactions in 2025, with a sales volume of approximately $50.9 billion. For additional information, please visit www.MarcusMillichap.com.