SM Energy Company, an independent oil and gas exploration and production company, detected unauthorized access to its systems around May 15, 2026. The company determined on June 30, 2026, that files containing personal information had been obtained by an unauthorized third party. Breach notices were mailed to affected individuals starting July 30, 2026, and the breach was also disclosed to the California Attorney General on the same date.
The exposed data included names, postal addresses, email addresses, phone numbers, and Social Security numbers or taxpayer identification numbers. While some reports mention dates of birth, government IDs, medical information, and financial information, these categories are not consistently confirmed across all sources. At least 3,931 individuals have been identified as affected through state filings, including residents of Texas, Massachusetts, and Vermont. The total nationwide number of affected individuals is not publicly known.
Further details about the breach, including a comprehensive list of all affected states and a definitive confirmation of all data types exposed, may emerge as investigations proceed. Official notifications were sent via U.S. mail.