Cushman & Wakefield Data Breach (2026): What Was Exposed & What To Do

In May 2026, the real estate services firm Cushman & Wakefield was the target of a data extortion campaign. A threat actor publicly released material it claimed to have taken from the company, affecting an estimated 310,000 individuals. The published records consisted mainly of corporate contact information. The incident was reported on 5 May 2026. No further details on the initial compromise, the volume of data stolen beyond the published portion, or any ransom negotiations have been disclosed.

Inside the incident

The group published the data after issuing a “pay or leak” demand. The material consisted of business contact records that included names, job titles, salutations, email addresses, phone numbers and physical addresses. Both internal Cushman & Wakefield email addresses and a large number of external addresses appeared in the release. The precise circumstances of the intrusion and whether additional data were obtained remain undisclosed.

Who is qilin?

Qilin is a ransomware-as-a-service operation that first appeared in public reporting in 2022. The group typically uses double-extortion tactics, encrypting systems and threatening to publish stolen data unless a ransom is paid. It has claimed responsibility for intrusions across multiple industries and maintains a leak site where it lists victims and, in some cases, posts sample files. Claims made on the site are not independently verified by the victims in every instance.

About Cushman & Wakefield

Cushman & Wakefield is a global provider of commercial real estate services, including property management, leasing, investment sales and facilities management. Organisations of this type routinely maintain large directories of employees, clients, vendors and building occupants. These directories contain the names, titles, direct contact details and office addresses needed to conduct day-to-day business.

What was likely exposed

The published data included email addresses, job titles, names, phone numbers, physical addresses and salutations. Public statements have not confirmed whether additional categories of information, such as financial records or internal documents, were also taken. The exact contents of any unreleased material therefore remain unconfirmed.

Why it matters

Contact data of this nature can be used to craft targeted phishing messages or to map organisational structures for social-engineering attacks. Individuals whose details appeared may receive an increased volume of unsolicited messages. For the company, the incident adds to the body of publicly available information about its personnel and business relationships, which can be referenced in future campaigns against the firm or its clients.

Were you affected?

Individuals can review any recent unsolicited messages that reference Cushman & Wakefield and consider whether the sender had access to the types of details listed above. Running a free exposure scan of an email address against known breach datasets provides one way to check whether the address has appeared in previously published collections. Organisations that hold similar contact directories can review access controls and logging around those systems.

AICompiled with AI assistance from public sources and published under our editorial standards.