HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

CUSHMAN & WAKEFIELD, INC.

bd_ad8121b21cc043a9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 29, 2026

Filed

Aug 7, 2026

To disclose

14 weeks

Affected

Not disclosed

Linked

8 records

Confidence

64%

Full breach record for CUSHMAN & WAKEFIELD, INC. →2 incidents on file

Cushman & Wakefield notified the California AG of a data breach where an unauthorized third party accessed and exfiltrated files between April 21 and April 29, 2026. The company became aware of the incident on April 29, 2026. Affected data includes names and potentially other personal information. The company engaged third-party cybersecurity experts, reset credentials, implemented heightened monitoring, and notified law enforcement. Complimentary identity monitoring is being offered to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d14 weeks discovery → filing

Incident timeline

undetected · 8 days

discovery → filing · 14 weeks / 100 days

Apr 21, 2026

Begins

Apr 29, 2026

Discovered

Aug 7, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 8 records about the same incident.View merged incident

A leak claim by shinyhunters about this victim was first seen 96 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteshinyhuntersbd_94dad4d39b7268ca2026-05-03 · +96dVerified by operator
Leak Siteqilinbd_f94238367dc882872026-05-03 · +96dVerified by operator

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_1baa16367dbbe7a12026-08-07Verified by operator
New Hampshire State AGbd_27631192cebaf0702026-08-07Verified
Indiana State AGbd_b957755283ab975d2026-08-07Verified
Massachusetts State AGbd_cdf44100b3bfaed92026-08-07Verified by operator

Press reports (1)

Pressshinyhuntersbd_73d80c5e639295172026-04-29 · +100dCandidate

Name: CUSHMAN & WAKEFIELD, INC.
norm: cushman wakefield
Domain: cushmanwakefield.com

Name: CUSHMAN & WAKEFIELD, INC.
norm: cushman wakefield
Domain: cushmanwakefield.com
Industry: Professional Servicesllm

Discovered: Apr 29, 2026
Breach occurred: Apr 21, 2026 – Apr 29, 2026
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Investigated the incident and secured our network with the assistance of third-party cybersecurity experts
Performed a broad-based reset of system passwords and access credentials
Implemented heightened monitoring across our environment
Notified law enforcement
Changes made: Offering complimentary access to Experian IdentityWorks for 24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGAug 7 · first

New Hampshire State AGAug 7 · first

Indiana State AGAug 7 · first

Massachusetts State AGAug 7 · first

California State AGAug 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-627946
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2026
Raw hash: 563b8880aec0e160254f16acb871efeb16707c37a6a81fe81b4aab9fc06562cf

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Press reports (1)

Reporting entityCUSHMAN & WAKEFIELD, INC.

Victim entityCUSHMAN & WAKEFIELD, INC.

Incidentdiscovered Apr 29, 2026

Stated responseInvestigated the incident and secured our network with the assistance of third-party cybersecurity experts

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov