Service Management Group, LLC, known as SMG, has notified individuals connected to its employees that a cybersecurity incident may have affected personal information the company held related to employment. SMG is a customer experience analytics company that serves large multi-location brands, and like any organization that handles employee data, it has a responsibility to keep that information secure.
SMG’s Data Breach Investigation
SMG reported that on March 31, 2026, it detected suspicious activity on its internal corporate systems, which it determined to be the result of a cybersecurity incident. The company stated it immediately launched an investigation and engaged third-party cybersecurity experts, and also notified law enforcement. SMG’s investigation found that an unauthorized party accessed certain internal corporate systems and obtained certain files between March 18 and April 7, 2026. The company said it has no evidence that personal information has been misused for purposes of fraud or identity theft as a result of the incident, and based on the mitigation steps it has taken, does not believe such misuse is likely to occur in the future. With the support of third-party experts, SMG then conducted a review of the affected files to identify individuals whose personal information may have been contained within them, a process the company said concluded on July 15, 2026.
Companies that provide business services to other companies, like SMG’s customer experience analytics platform, often maintain internal corporate systems containing not just customer data but also sensitive employment-related records for their own workforce, including Social Security numbers and government-issued identification numbers. These internal HR-adjacent systems can be an attractive target for cybercriminals because they frequently contain the kind of concentrated, high-value personal information that enables identity theft, even when the breached company’s core business does not directly involve consumer data.
The nearly four-month gap between SMG’s initial detection of suspicious activity in March 2026 and its completion of a detailed review in July 2026 reflects a common reality in corporate data breach investigations: identifying exactly which individuals’ information appeared in compromised files, and confirming current contact information for each of them, is often the most time-consuming part of the response, even after the underlying security issue itself has been contained.
SMG’s decision to offer complimentary identity monitoring through Experian IdentityWorks, a step increasingly standard across corporate data breach responses, reflects an effort to give affected individuals tools to detect and respond to any downstream fraud attempts, even in the absence of confirmed misuse of the exposed data to date.
When Did This Breach Occur?
SMG detected suspicious activity on March 31, 2026. Its investigation determined that unauthorized access to its systems, and the copying of certain files, occurred between March 18 and April 7, 2026. The company completed its review to identify affected individuals on July 15, 2026.
What Information Was Breached?
According to SMG’s notification, the information involved may have included one or more of the following: name, Social Security number, driver’s license number, other government-issued identification number, and health and dental insurance information.
What You Can Do
SMG is offering a complimentary 24-month membership in Experian IdentityWorks, which includes credit monitoring, identity restoration support, and $1 million in identity theft insurance. If you received a notification letter from SMG, consider taking the following steps:
- Enroll in the complimentary Experian IdentityWorks membership described in your notification letter before the enrollment deadline.
- Review your credit reports and financial account statements regularly for unauthorized activity.
- Consider placing a fraud alert or security freeze on your credit file with the three major credit bureaus.
- Be cautious of unsolicited communications referencing this incident, which scammers sometimes use to attempt further fraud.
File a Data Breach Lawsuit Against SMG
If you received a data breach notification letter from SMG (Service Management Group) or believe your personal information was compromised in this incident, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
