2026 SM Energy — unauthorized system access; SSNs (≥3,851 TX residents)
Data compromised
Names, postal addresses, email addresses, phone numbers, and Social Security numbers or taxpayer identification numbers (varied by person)
Technical writeup
Verified company/regulator notices — July 30, 2026 notifications. SM Energy Co. (Denver E&P) experienced unauthorized access to certain systems on or about May 15, 2026; investigation concluded June 30 that an unauthorized party obtained files containing personal information. California AG filing dated July 30, 2026. State tallies cited in trade summaries include 3,851 Texas residents, 71 Massachusetts, and 9 Vermont; national total not fully published. Catalog indexes 3851 as the largest attested state count. Company offering 24 months Experian IdentityWorks (enroll by Oct 31, 2026). Distinct from Australia’s Origin Energy ~900k customer breach.
Root cause
Cybersecurity incident with unauthorized access to company systems on or about May 15, 2026; determined June 30 that files with personal information were obtained