Were you recently affected by a data breach?
SM Energy Company, a Denver-based oil and natural gas producer, notified Vermont regulators that a data breach exposed Social Security numbers belonging to individuals connected to the company.
Who was affected:
Impacted Data:
Social Security numbers
SM Energy Company, an independent oil and natural gas company headquartered in Denver, Colorado, has notified the Vermont Attorney General’s Office of a data breach that exposed Social Security numbers belonging to individuals connected to the company.
Companies that collect and store Social Security numbers and other sensitive personal information have a legal and ethical responsibility to keep that data secure, and a breach of this kind can leave affected individuals vulnerable to identity theft and fraud for years to come.
SM Energy Company reported to the Vermont Attorney General’s Office on July 31, 2026, that a data breach had exposed the Social Security numbers of individuals connected to the company. According to the filing, nine Vermont residents were affected, and the company categorized the incident as involving Social Security numbers as the only compromised data type currently disclosed. SM Energy has not publicly released additional details about how the breach occurred, when it was first discovered, or how many individuals nationwide may have been affected beyond the Vermont-specific figure reported to that state’s regulator.
State attorney general notification requirements like the one that prompted this Vermont filing exist because Social Security numbers are among the most sensitive pieces of personal data a company can hold. Once exposed, a Social Security number cannot be changed the way a password or credit card number can, which means the risk of misuse can persist indefinitely. Cybercriminals who obtain Social Security numbers frequently use them to open fraudulent credit accounts, file false tax returns, apply for government benefits under a victim’s identity, or combine the number with other stolen data points to pass identity-verification checks at financial institutions.
Energy sector companies, including exploration and production firms like SM Energy, have increasingly become targets for cybercriminals in recent years. Oil and gas operators maintain large employee and contractor databases, vendor payment systems, and royalty-owner records that often include Social Security numbers for tax-reporting purposes, making these companies attractive targets even though they are not typically thought of as data-driven businesses the way retailers or healthcare providers are. Threat actors have also shown a growing interest in critical infrastructure and energy operators generally, given the potential for both financial gain from stolen data and disruption to operations.
When a company like SM Energy discloses a breach only to a state regulator such as the Vermont Attorney General’s Office, without a broader public statement or a nationwide notification campaign, it can leave affected individuals uncertain about whether they were personally impacted. Individuals connected to SM Energy Company, whether as employees, contractors, royalty owners, or vendors, who have not yet received a direct notification letter should not assume they are unaffected. It is common for state-by-state breach notification filings to be made public before individual notification letters are fully distributed, and additional affected states or a higher total count could still be disclosed as the company’s investigation continues.
Companies are generally required to notify affected residents and state regulators within a specific window after discovering a breach, though exact timelines vary by state law. When multiple states are affected, filings can trickle in over the following weeks or months as each state’s separate disclosure requirements are satisfied, which is why a single state’s filing, like the one made with Vermont here, often represents only a fraction of the full picture. Affected individuals in other states may receive similar notices later, even before their state’s specific figures become public.
Because SM Energy Company has not disclosed the cause of the incident, individuals should be cautious of any follow-up phishing attempts that reference the breach. Scammers often use news of a real data breach to send fraudulent emails or texts posing as the affected company, asking recipients to verify their identity or account details without any legitimate reason to do so. A legitimate breach notification will never ask a recipient to provide a full Social Security number or password by email or text message.
Individuals with a business or financial relationship to SM Energy Company should monitor their financial accounts, credit reports, and any correspondence from the company closely in the weeks following this disclosure. Even a breach affecting a relatively small number of people in one state can be part of a larger, still-unfolding incident.
SM Energy Company reported the breach to the Vermont Attorney General’s Office on July 31, 2026. The company has not publicly disclosed when the underlying security incident actually occurred or when it was first discovered internally, and it is common for the date of discovery to precede a public or regulatory disclosure by weeks or months while a company completes its investigation.
According to SM Energy Company’s filing with the Vermont Attorney General’s Office, the breach exposed Social Security numbers belonging to nine Vermont residents. The company has not disclosed whether any additional categories of personal information, such as names, addresses, or financial account details, were also involved, or whether individuals in other states were affected by the same incident.
If you have received a notice from SM Energy Company about this breach, or believe you may have been affected, consider taking the following steps:
If you were notified that your personal information was exposed in the SM Energy Company data breach, you may have legal options available to you. Companies that collect sensitive information like Social Security numbers are expected to implement reasonable safeguards to protect it, and a failure to do so can form the basis of a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
A data breach occurs when sensitive, confidential, or protected information is accessed, stolen, or disclosed without authorization. Data breaches often occur through phishing emails, malware, weak passwords, insider threats, or unsecured databases. Indicators of a data breach can include unexpected password resets, suspicious account activity, unauthorized transactions, or notifications from companies about compromised information.If you suspect your data has been compromised, you must take measures and act quickly. Change passwords, enable two-factor authentication, review your financial accounts for unusual activity and consider freezing your credit.
Once stolen, your personal information may be sold on the dark web or used for identity theft and financial fraud. In some cases, hackers use the data to extort companies or launch further attacks. Victims often face long-term risks, including damage to credit and privacy.
If you receive a data breach notification, don’t ignore it. Immediately change passwords for the affected account and any others that share credentials. Enroll in any free credit monitoring services offered and monitor financial statements closely.
To pursue a data breach claim, you’ll need documentation showing your information was compromised and proof of resulting harm, such as fraudulent charges, credit score damage, or identity theft reports. Notification letters, financial records, and communication with the breached company can help support your claim.
Yes. If a company fails to protect consumer data or delays notifying victims, it may be held liable under state and federal privacy laws. Many victims join class action lawsuits to recover financial losses and hold negligent organizations accountable.
Data breach settlements vary widely depending on the size of the breach, type of data compromised, and damages suffered by victims. Payouts may include cash compensation, identity theft protection, or reimbursement for losses. Many settlements range from a few hundred to several thousand dollars per person. A skilled data breach lawyer can guide victims through the complex legal process, ensuring their rights are protected. If you’ve received a data breach notification or believe your personal data was exposed, you may be eligible for compensation. Contact Class Action U to learn more about how to join a data breach lawsuit and understand the process of filing.
