FEDERALMalwareRansomwareData ExfiltratedData EncryptedEmployee Data InvolvedDelayed DiscoveryMulti-Stage ChainPIIIdentity (basic)Government IDEmploymentMediumContained

Smith Midland Corp

bd_bd42d31eca78014e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2025

Filed

Apr 14, 2026

To disclose

16 months

Affected

Not disclosed

Confidence

64%

Full breach record for Smith Midland Corp →2 incidents on file

A ransomware incident identified early in 2025 affected the Company's operating systems, which were recovered without paying a ransom. A first-quarter 2026 investigation by a third-party consulting firm determined that the incident resulted in exfiltration of some employee information, including names, addresses, and Social Security numbers. Affected-individual notifications are ongoing. The Company reports no material operational impact and additional safeguards have been implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 months / 468 days

Jan 1, 2025

Begins

Jan 1, 2025

Discovered

Apr 14, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: Smith Midland Corp
norm: smith midland
SEC CIK: 0000924719
Domain: smithmidland.com

Name: Smith Midland Corp
norm: smith midland
Domain: smithmidland.com

Discovered: Jan 1, 2025
Breach occurred: Jan 1, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDEmployment
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Recovered the Company's operating systems
No ransom was paid by the Company
Investigated the incident together with a third-party consulting firm
Notifying affected individuals is ongoing
Most out-of-pocket expenses covered by cyber insurance
Changes made: Implemented additional safeguards designed to detect and prevent cybersecurity events in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(468 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/924719/000165495426003505/smid_10k.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 14, 2026
Raw hash: 2eb0ba55b5f7faec402378a482bb5d2d97c15aa71dd5e48f185409ff03d512e1

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.1 MB

Download View at source

Reporting entitySmith Midland Corp

Victim entitySmith Midland Corp

Incidentdiscovered Jan 1, 2025

Stated responseRecovered the Company's operating systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing