Hackers had roughly six weeks of undetected access to SM Energy‘s systems before the company even confirmed personal information was taken. At least 3,931 people across four states have now been notified that their Social Security numbers were exposed.
SM Energy Company, a Denver-based, NYSE-listed independent oil and gas exploration and production company, experienced a cybersecurity incident on or around May 15, 2026. The company determined on June 30, 2026 that an unauthorized third party had accessed its systems and obtained files containing personal information, and it mailed notification letters to affected individuals on July 30, 2026, roughly two and a half months after the incident was first identified.
SM Energy has filed notice in at least four states: 3,851 Texas residents, 71 Massachusetts residents, and 9 Vermont residents, plus a California Attorney General disclosure that doesn’t include a population figure under that state’s reporting policy. That adds up to 3,931 confirmed people so far. Because SM Energy operates wells and holds mineral and royalty interests across multiple states, the true nationwide total is plausibly larger than what’s been confirmed in these state filings, though that hasn’t been independently confirmed.
Per SM Energy’s own notification letter, the types of information affected varied by individual and included:
SM Energy is offering two years of complimentary identity protection and credit monitoring through Experian IdentityWorks. According to the company’s notice, affected individuals must enroll by October 31, 2026, or their activation code will stop working.
A Social Security or Taxpayer Identification number combined with a name, address, and contact information is enough to open new credit accounts, file a fraudulent tax return, or pass identity checks in someone else’s name. The six-week window between the initial intrusion and SM Energy’s confirmation that data was taken means the exposed information had time to circulate before anyone affected knew to watch for misuse.
Companies that collect Social Security numbers and taxpayer identification numbers, whether from employees, vendors, or royalty and mineral-interest owners, have a legal duty to safeguard that information and to notify affected individuals without unreasonable delay.
How many people were affected by the SM Energy data breach?
At least 3,931 people, confirmed across Texas, Massachusetts, and Vermont state filings, plus a California disclosure without a published population figure. No national total has been released.
What information was exposed?
Name, postal address, email address, phone number, and Social Security number or Taxpayer Identification Number, per SM Energy’s own notification letter.
Is SM Energy offering credit monitoring?
Yes. SM Energy is offering two years of complimentary identity protection and credit monitoring through Experian IdentityWorks. Enrollment closes October 31, 2026.
Do I have a legal claim?
Companies that collect Social Security numbers have a legal duty to protect that information and to notify affected individuals within a reasonable time. If you received a notice from SM Energy, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 for a Free Case Review.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
