Reported to the CA Attorney General on July 30, 2026.
CA residents may qualify for compensation. Free attorney review — no obligation, no upfront cost.
Check My Rights →SM Energy Company was the subject of a data breach notification filed with the CA Attorney General. The AG filing was recorded on July 30, 2026. The breach or discovery date reported in the filing is May 15, 2026.
SM Energy Company is an independent energy enterprise engaged in the acquisition, exploration, development, and production of oil and gas properties, primarily operating within prominent onshore basins in the United States. Because of the complex administrative, operational, and financial infrastructure required to manage large-scale resource extraction and corporate partnerships, organizations in the energy sector maintain extensive repositories of highly confidential data. This includes sensitive corporate records, proprietary operational assets, and a vast amount of personal identifiable information pertaining to current and former employees, contractors, landowners, mineral rights holders, and corporate vendors. In 2026, SM Energy Company reported a significant data security incident to the California Attorney General, alerting affected individuals that their private records had been compromised. While specific investigative details vary in the wake of such attacks, breaches within the energy and natural resources sector frequently involve sophisticated cybercriminal operations, such as ransomware deployments, unauthorized intrusions into corporate networks, or third-party vendor compromises. Because energy companies often rely on complex supply chains and interconnected digital control environments, an intrusion at any single point of vulnerability can expose massive amounts of centralized administrative and human resources data. The breach exposed a variety of sensitive categories of personal information, each carrying distinct and severe risks to the affected individuals. The compromise of core identifiers such as Full Names, Social Security Numbers, and Dates of Birth strips away foundational layers of personal privacy, directly exposing victims to the immediate and enduring threat of identity theft, synthetic fraud, and unauthorized credit applications. Furthermore, the potential exposure of employment, payroll, banking, and tax-related information creates acute vulnerabilities for financial account takeover, fraudulent tax filings, and unauthorized access to direct deposit funds. Malicious actors routinely leverage this type of combined dossier to execute targeted phishing schemes and financial fraud. As an enterprise operating within California and maintaining the private data of state residents, SM Energy Company was bound by rigorous legal and regulatory obligations to safeguard this information. Under state statutes such as the California Confidentiality of Medical Information Act and the broader provisions of the California Consumer Privacy Act, alongside common law duties of care, companies holding sensitive personal data are required to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The occurrence of a successful data breach of this magnitude serves as a strong indicator that the company may have failed to fulfill these statutory and common law mandates, potentially through inadequate network segmentation, delayed patch management, or insufficient encryption standards. Receiving a data breach notification letter from SM Energy Company is a formal acknowledgment that your private information was compromised due to corporate security shortcomings, and it establishes the legal standing necessary to participate in a class action lawsuit. Affected individuals do not need to wait until they experience actual financial fraud or out-of-pocket losses to seek legal recourse; the increased risk of future identity theft and the time required to monitor compromised accounts constitute actionable harms under the law. Our firm evaluates these matters on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront fees for class members, and we only recover compensation if a successful recovery is secured on your behalf.
Based on the data types reported in this filing, affected individuals face the following specific risks:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Under the California Consumer Privacy Act (CCPA), you may have a legal claim against SM Energy Company if any of the following apply:
Applicable law: This breach was reported under the California Consumer Privacy Act (CCPA), which establishes your right to seek damages from SM Energy Company.
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under California Consumer Privacy Act (CCPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from SM Energy Company does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by SM Energy Company during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Received a notification letter from SM Energy Company?
Read our dedicated guide — what the letter means and exactly what to do.
If you were affected by the SM Energy Company data breach, you may be entitled to compensation. Submit your information below for a free attorney review — no obligation, no upfront cost.
Source: State Attorney General filing, CA
View Official AG Filing →SM Energy Company breach?
Free case review · No fee unless you win