Service Management Group, LLC (SMG), a privately held experience management company, detected suspicious activity on its internal corporate systems on March 31, 2026. An investigation, conducted with third-party cybersecurity experts, determined that an unauthorized party accessed certain SMG internal systems and obtained files between March 18 and April 7, 2026. By July 15, 2026, SMG confirmed that some affected files contained sensitive personal information related to employees or their family members.
The compromised data includes names, Social Security numbers, dates of birth, addresses, driver's license/government ID numbers, medical/dental insurance information, medical records, and financial information. The company disclosed the breach to the Massachusetts Attorney General’s office on September 11, 2026. The exact number of affected individuals and all states involved have not been publicly confirmed.
Details can continue to emerge as investigations progress. Consumer notification letters were sent by September 15, 2026, offering 24 months of identity protection services.