Almeida Law Group is investigating a data breach at SM Energy Company. The breach occurred on May 15th–19th, 2026 and was discovered on June 30th, 2026. If you were affected, contact Almeida Law Group.
About SM Energy Company
SM Energy Company is an independent oil and gas exploration and production company founded in 1908 and headquartered at 1700 Lincoln Street, Suite 3200, Denver, Colorado. It is publicly traded on the NYSE under the ticker SM. The company operates across several basins, including the Permian Basin in West Texas and New Mexico and the Denver-Julesburg Basin in Colorado. Civitas Resources merged with SM Energy Company effective January 30th, 2026.
What Happened?
SM Energy Company was listed in a Texas Attorney General data security breach report (record ID BR-0005218). According to that filing, the breach took place between May 15th, 2026 and May 19th, 2026 and was discovered on June 30th, 2026—roughly six weeks after the incident. A total of 40,109 individuals were affected. Compromised information includes names, addresses, Social Security Number information, and an additional category listed as “Other” in the filing; SM Energy has not publicly clarified what the “Other” category covers. Notifications were sent to affected consumers by U.S. Mail. The breach was also reported to the Vermont Attorney General on July 31st, 2026.
No public reporting has attributed this incident to a specific threat actor or ransomware group, and no company press release, SEC filing, or media coverage describing the nature of the attack has been identified as of July 31st, 2026.
Key Facts at a Glance
- Company or Organization: SM Energy Company
- Industry: Oil and Gas Exploration and Production (NAICS 211)
- Location: Denver, Colorado 80203
- Incident type: Data breach (type of attack not publicly specified)
- Date of breach: May 15th, 2026 – May 19th, 2026
- Date breach discovered: June 30th, 2026
- Date of consumer notification: July 31st, 2026
- Total persons affected: 40,109
- Source: Texas Attorney General data security breach report, BR-0005218 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005218); Wikipedia (https://en.wikipedia.org/wiki/SM_Energy); Class Action U (https://classactionu.org/current-data-breaches/medtronic/)
What Should You Do?
If you received a notification letter from SM Energy Company, review it carefully for any identity theft protection enrollment instructions and sign up before any stated deadline. Regardless of whether you enroll in offered services, you should place a fraud alert or credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion—to limit unauthorized account openings. Monitor your existing financial accounts and check your credit reports for free at AnnualCreditReport.com. If you spot signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance. Because Social Security Number information was involved, staying vigilant over the long term is especially important.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
