
SM Energy Co., an independent oil and gas exploration and production company headquartered in Denver, Colorado, disclosed a data breach involving unauthorized access to certain company systems on or around May 15, 2026. The total number of individuals affected nationwide has not been disclosed, but included 3,851 Texas residents, 71 Massachusetts residents and nine Vermont residents.
SM Energy determined on June 30, 2026, that an unauthorized third party had obtained files containing personal information.
On or around May 15, 2026, SM Energy experienced a cybersecurity incident involving unauthorized access to certain company systems, according to the company's notification letter to affected individuals. After becoming aware of the issue, the company began an investigation to determine the nature and scope of the incident.
The investigation found that an unauthorized third party had accessed certain SM Energy systems and obtained files containing personal information. The types of information exposed varied by individual but included names, postal addresses, email addresses, phone numbers and Social Security numbers or taxpayer identification numbers.
The breach was additionally disclosed to the California Attorney General on July 30, 2026. The company is notifying affected individuals by U.S. mail on July 30, 2026.
SM Energy is offering affected individuals 24 months of complimentary identity protection and credit monitoring through Experian IdentityWorks.
Affected individuals must enroll by Oct. 31, 2026, using the activation code included in their notification letter. Enrollment is available online at the Experian IdentityWorks website.
For questions about the breach, SM Energy has set up a dedicated toll-free call center at 1-833-918-6683, available Monday through Friday from 8 a.m. to 8 p.m. Central Time, excluding major U.S. holidays. Individuals calling from outside the U.S. and Canada can reach the line at +1-214-393-3260.








.webp)
.webp)
.webp)

.webp)
.webp)
.webp)
.webp)