SM Energy data breach exposes Social Security numbers at Denver oil and gas producer (2026)

On 30 July 2026, SM Energy — a Denver-based, NYSE-listed independent oil and gas exploration and production company — began mailing notification letters informing individuals that a cybersecurity incident had exposed their personal information, including Social Security numbers.

What happened

According to the company's filings, an unauthorized third party accessed SM Energy's systems on or around 15 May 2026. On 30 June 2026, the company determined that files containing personal information had been accessed and obtained. After completing its review, SM Energy mailed notification letters on 30 July.

The exposed records included names, postal and email addresses, phone numbers, and Social Security or taxpayer identification numbers — a combination well suited to identity theft and financial fraud.

Scope and response

SM Energy filed breach notices in several U.S. states, reporting at least 3,931 affected individuals across those state filings — including thousands of Texas residents — while noting that a nationwide total had not been disclosed. As is standard for incidents involving Social Security numbers, the company offered affected individuals 24 months of complimentary credit monitoring through Experian, with an enrolment deadline later in the year, and several law firms opened investigations into potential class-action claims.

Why it matters

While smaller in headcount than the year's marquee breaches, the SM Energy incident is a reminder that energy-sector companies hold substantial employee and counterparty personal data alongside their operational systems. The roughly two-and-a-half-month gap between the May intrusion and the late-July notifications is typical of data-breach response timelines and leaves affected individuals exposed to fraud during the interval before they learn of the compromise.