Marcus & Millichap, Inc.
For the period ended Jun 30, 2026. Filed Aug 6, 2026.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Jun 30, 2026 · Filed Aug 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2026-03-31; filed 2026-05-07.
0001628280-26-032300
Item 1A. Risk FactorsCurrent report: 10-Q
Period ended 2026-06-30; filed 2026-08-06.
0001628280-26-054439
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 5 previous paragraphs and 5 current paragraphs.
4 unchanged; 1 reworded; 0 added; 0 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Reworded paragraphs (1)
Previous wording
In April 2026, the Company experienced a cybersecurity incident in which a threat actor used social engineering techniques to obtain an employee's login credentials and gain unauthorized access to certain Company systems, resulting in the exfiltration of certain customer, employee, and internal business data. The Company promptly detected the incident, contained the unauthorized access, and engaged outside cybersecurity and legal counsel to assist with its response. The Company's systems and business operations were not disrupted, and the Company does not believe the incident has had a material impact on its business, financial condition or results of operations. The Company's investigation remains ongoing, and there can be no assurance that this or future cybersecurity incidents will not adversely affect our reputation, brand, business, financial condition, and results of operations, or result in future costs, litigation, or regulatory proceedings.
Current wording
In April 2026, the Company experienced a cybersecurity incident in which a threat actor used social engineering techniques to obtain an employee's login credentials and gain unauthorized access to certain Company systems, resulting in the exfiltration of certain customer, employee, and internal business data. The Company promptly detected the incident, contained the unauthorized access, and engaged outside cybersecurity and legal counsel to assist with its response. The Company's systems and business operations were not disrupted, and the Company does not believe the incident has had a material impact on its business, financial condition or results of operations. There can be no assurance that future cybersecurity incidents will not adversely affect our reputation, brand, business, financial condition, and results of operations, or result in future costs, litigation, or regulatory proceedings.