Citizens Financial Group Investigates Third-Party Data Breach Amid Ransomware Claims Citizens Financial Group confirmed on April 21 that it is addressing a data security incident involving a third-party vendor, though the bank insists its own systems remain uncompromised. According to the statement, most of the exposed data consisted of masked test records, with only a limited set of customer information affected. The bank reported no disruption to operations and no evidence of unauthorized access to its internal network. The incident coincides with claims from the Everest ransomware group, which has listed Citizens as a victim and alleged possession of millions of records. Cybersecurity researchers, citing a report by Cybernews, note that the threat actors have shared sample data and set a deadline for negotiations a common extortion tactic. The purported dataset may include personal details such as names, addresses, and account-related information, though the full scope and accuracy of these claims remain unverified. Citizens Financial Group has heightened monitoring efforts and is notifying impacted individuals, emphasizing its commitment to data protection. The bank has not confirmed whether the ransomware group’s claims directly correlate with the third-party breach.

The Vermont Office of the Attorney General reported that Citizens Bank experienced a data breach affecting approximately 100 customers. The breach, which occurred between January 10, 2024, and June 13, 2024, potentially compromised customer names, account numbers, and Social Security Numbers. The breach was reported on September 26, 2024.