SM Energy data breach: files with Social Security numbers taken, 40,109 people

What happened at SM Energy?

The company's letter says the incident happened on or around May 15, 2026 and involved unauthorized access to some company systems. On June 30, 2026 its investigation confirmed that files containing personal information had been taken. It says it blocked the access, strengthened its safeguards and reported the matter to law enforcement. The letter does not say how the intruder got in, and it does not use the word ransomware.

Date	What happened	Source
On or around May 15, 2026	Unauthorized access to company systems	SM Energy letter; Indiana report
June 30, 2026	Investigation confirms files with personal data were taken	SM Energy letter
July 30, 2026	Notice recorded in Indiana	Indiana report
October 31, 2026	Last day to enroll in Experian IdentityWorks	SM Energy letter

Notice followed 76 days after the incident and 30 days after the theft was confirmed. The notice-delay guide shows how that compares.

What information was exposed?

It varies by person. The letter lists name, postal address, email, phone number, and Social Security number or taxpayer identification number. The letter does not say whose records the files held.

How many people were affected?

40,109 in total, per Indiana's report, including 95 Indiana residents. The company's letter gives no count. The largest data breaches of 2026 shows where it sits this year.

Texas's attorney general lists a report from SM Energy Company, posted on July 31, 2026, with 3,851 Texans affected. The Texas record lists names, addresses, Social Security numbers and other information among the information involved. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

Can I still sign up for the free credit monitoring?

Not with the code in the letter. The letter offers 24 months of Experian IdentityWorks at no cost and says to enroll by October 31, 2026, after which the code stops working. Experian's identity restoration help does not require enrollment, the letter says: call 1-833-918-6683 with the engagement number printed in the letter. The same number answers questions about the incident, Monday to Friday, 8:00 a.m. to 8:00 p.m. Central Time. A credit freeze is free at Equifax, Experian and TransUnion and has no deadline; the guide to credit monitoring offers explains the difference.

Did SM Energy report the breach to the SEC?

No. SM Energy's common stock is registered on the New York Stock Exchange. Even so, EDGAR's filing index shows no Form 8-K under Item 1.05 or Item 8.01 from May 15 to November 12, 2026. Neither of its quarterly reports since the breach, filed on August 6 and November 4, 2026, mentions the incident. The only public account is the notice letter and the state records above. A company files under Item 1.05 only for an incident it judges material, and the Item 1.05 guide explains that test.

What the record leaves open

• How the third party got into the systems, and whether any were encrypted.
• Whether the people affected are employees, business contacts or others.
• Whether the company will file anything about it with the SEC; an EDGAR full-text search on November 11, 2026 found nothing.