Cushman & Wakefield data breach: files taken in April 2026, and 250,576 people on Indiana's list

How many people were affected by the Cushman & Wakefield data breach?

250,576 in total, according to the number the company reported to Indiana. The letter gives no count. The two state lists that publish this notice count their own residents:

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by Cushman & Wakefield	250,576	Notice August 7, 2026
Indiana attorney general	Indiana residents	31	Notice August 7, 2026
Massachusetts consumer affairs office	Massachusetts residents	20	Reported August 7, 2026

Massachusetts marks Social Security numbers as breached for its 20 residents, and no other category.

What happened at Cushman & Wakefield?

Date	Event
April 21, 2026	Breach date on Indiana's record
April 29, 2026	Cushman & Wakefield becomes aware of the unauthorized access
August 7, 2026	Letters dated; notices recorded in Indiana and Massachusetts
November 4, 2026	Third-quarter 10-Q lists legal costs tied to a cyber incident
November 30, 2026	Deadline to enroll in Experian IdentityWorks

After learning of the access, the company says it reviewed a substantial volume of data to work out whose information was in the exfiltrated files. It reset system passwords and access credentials across the company, added monitoring and told law enforcement.

What information was involved?

Each letter names the reader's name and its own further items; the filed copy leaves that part as a placeholder. Massachusetts records Social Security numbers. The letter also says Cushman & Wakefield has seen no sign that the information was actually viewed or misused. Its advice includes changing passwords and, where official identification data was affected, following the issuing authority's guidance.

What is Cushman & Wakefield offering?

Item	Detail from the letter
Service	Experian IdentityWorks for 24 months, with identity restoration support
Enrollment deadline	November 30, 2026, 11:59 p.m. UTC, with the code printed on the letter
Help line	833-918-6825, Monday to Friday, 8 a.m. to 8 p.m. Central Time, except major U.S. holidays

The guide to credit monitoring offers compares offers like this one.

Did Cushman & Wakefield tell investors about the breach?

Not as a separate disclosure. Cushman & Wakefield files reports with the SEC. Its quarterly report for July to September 2026, filed November 4, mentions "legal costs associated with a cyber incident" as one of the items in the "Other" line of its adjusted EBITDA reconciliation. It names neither the incident nor the amount. The company filed no 8-K about the breach. The guide to Item 8.01 versus Item 1.05 explains the forms a listed company can use.

What the documents leave open

• How the third party got in, and which systems or files were reached.
• Who the 250,576 people are: employees, tenants, clients or others.
• Whether the 10-Q's cyber incident is this one, and what it has cost.