Cushman & Wakefield Suffers ShinyHunters Data Extortion, 310K Accounts Breached
In May 2026, the real estate services firm Cushman & Wakefield was targeted by the ShinyHunters group in a “pay or leak” extortion campaign. Following the firm’s non-compliance, ShinyHunters publicly released data they claimed was exfiltrated from Cushman & Wakefield, affecting over 310,000 accounts.
Have I Been Pwned reports that the exposed data primarily consisted of Cushman & Wakefield email addresses, alongside tens of thousands of external email addresses and corporate contact records. The breach exposed critical business information, including names, job titles, company addresses, and phone numbers.
This incident underscores the persistent threat of extortion groups leveraging stolen data for financial gain. The exposure of corporate contact information creates a significant risk for targeted phishing and social engineering attacks against both Cushman & Wakefield employees and their external contacts.
What This Means For You
- If your organization's employees or third-party contacts were exposed in the Cushman & Wakefield breach, assume their corporate contact details are now in the hands of threat actors. Mandate vigilance against highly targeted phishing attempts. Review your security awareness training with an emphasis on social engineering tactics that leverage publicly available business contact information.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
ShinyHunters Data Extortion - Public Data Leak
Written by SCW Research
Related coverage on
Instructure Reaches Ransom Agreement with ShinyHunters to Stop Canvas Leak
American educational technology firm Instructure, parent company of Canvas, has reportedly reached an "agreement" with the cybercrime group ShinyHunters following a breach. The Hacker News...
Checkmarx Jenkins Plugin Compromised with Infostealer
Checkmarx has confirmed that a malicious version of its Jenkins Application Security Testing (AST) plugin was briefly distributed on the Jenkins Marketplace. BleepingComputer reports that...
GhostLock Tool Abuses Windows API to Block File Access
A new proof-of-concept tool, GhostLock, demonstrates a critical abuse case for legitimate Windows file APIs. BleepingComputer reports that GhostLock can effectively block access to files,...