Smith-Midland Reports Record 2025 Financials Amidst Internal Control Weaknesses & Data Breach
Summary
Smith-Midland reported record full-year 2025 revenue and net income, but also disclosed material weaknesses in internal controls and a cybersecurity incident involving employee data exfiltration.
Key Events
-
Record Full-Year 2025 Financial Results
The company reported record full-year 2025 revenue of $93.4 million, a 19% increase from 2024, and net income of $12.5 million, a 63% increase. Basic and diluted earnings per share rose to $2.36 from $1.45 in 2024. This reiterates information from an 8-K filed on the same day.
-
Material Weaknesses in Internal Controls Identified
Management concluded that internal controls over financial reporting were not effective as of December 31, 2025, due to material weaknesses in entity-level controls, financial reporting processes, monthly financial close, and IT general controls. Remediation efforts are underway.
-
Cybersecurity Incident Led to Data Exfiltration
A ransomware incident in early 2025 resulted in the exfiltration of some employee information, including names, addresses, and Social Security numbers. While systems were recovered and out-of-pocket expenses were covered by cyber insurance, the incident may lead to regulatory inquiries or litigation.
-
Sales Backlog Decreased Year-Over-Year
As of March 3, 2026, the sales backlog was approximately $53.1 million, a decrease from $59.5 million around the same time in the prior year, primarily due to the completion of large projects and timing of new contract awards.
Analysis
This annual report confirms Smith-Midland's record financial performance for 2025, which was previously announced in an 8-K filing on the same day. However, it also discloses significant new material information regarding identified material weaknesses in internal controls over financial reporting and details of a cybersecurity ransomware incident that resulted in the exfiltration of employee personal information. While the strong financial results are positive, these operational and compliance risks introduce considerable uncertainty and could impact future financial reliability and expose the company to regulatory and legal challenges. Investors should monitor the company's remediation efforts for internal controls and the potential fallout from the data breach.
At the time of this filing, SMID was trading at $32.57 on NASDAQ in the Manufacturing sector, with a market capitalization of approximately $170.1M. The 52-week trading range was $25.60 to $43.66. This filing was assessed with neutral market sentiment and an importance score of 7 out of 10.