Cybersecurity Breach at William C. Smith and Company Exposes PII On May 18, 2025, Washington, D.C.-based real estate firm William C. Smith and Company detected unauthorized access to its network following suspicious activity. A third-party cybersecurity investigation revealed that an unknown threat actor had infiltrated company systems between May 5 and May 18, 2025, accessing and exfiltrating files containing personally identifiable information (PII). The breach exposed sensitive data, including names and Social Security numbers. A review to assess the scope of the incident concluded on October 21, 2025, identifying at least three Maine residents among those affected. The total number of impacted individuals across the U.S. remains undisclosed. On January 12, 2026, the company notified affected consumers via written notice and filed disclosures with the Maine and Vermont Attorneys General. In response to the breach, William C. Smith and Company contained the incident, secured its systems, and reported the matter to federal law enforcement and state regulators. To mitigate potential harm, the firm is offering 12 months of complimentary credit monitoring and identity restoration services through Experian to impacted individuals. The company also provided guidance on protective measures, such as monitoring financial accounts, obtaining credit reports, and placing fraud alerts or credit freezes. The incident underscores the ongoing risk of PII exposure in cyberattacks targeting corporate networks.