William C. Smith and Co. Data Breach Exposes Social Security Numbers

On May 18, 2025, William C. Smith and Company, a Washington, D.C.-based real estate firm, discovered suspicious activity on its computer network.

An investigation by third-party cybersecurity specialist revealed that an unknown actor had gained unauthorized access to certain company systems between May 5, 2025, and May 18, 2025. During this window, files were accessed and taken from the network.

A thorough review was conducted to determine the scope of the breach and to identify the individuals whose information may have been impacted. The review process concluded on Oct. 21, 2025.

The exposed information includes personally identifiable information like names and Social Security numbers.

According to the disclosure to the Maine Attorney General, three Maine residents were affected. The total number of affected individuals in the United States has not yet been reported.

On Jan. 12, 2026, the company provided a written notice to consumers and also published the disclosure to the Vermont Attorney General.

William C. Smith and Company's response

After discovering the incident, William C. Smith and Company took steps to contain the breach and secure its systems. The company notified federal law enforcement and relevant state regulators.

To support those affected, the company is offering twelve months of complimentary credit monitoring and identity restoration services through Experian. Instructions for enrolling in these services were included in the written notification sent to impacted individuals.

In addition, the company has provided guidance on steps individuals can take to protect themselves from identity theft or fraud. These steps include:

• Monitoring account statements
• Obtaining free credit reports
• Placing fraud alerts or credit freezes

Given the nature of the information involved, affected individuals are encouraged to remain vigilant and take advantage of the free credit monitoring services.

Those who notice suspicious activity should report it to their financial institutions and consider contacting the Federal Trade Commission, state attorney general or local law enforcement.