Citizens Bank Hit by Ransomware Attack, 3.4 Million Records Exposed On April 20, 2026, the Everest ransomware gang listed Citizens Bank, N.A. on its dark web leak site, claiming to have stolen approximately 3.4 million customer records. The breach, which also affected Texas-based Frost Bank, involved sensitive financial data, including names, home addresses, and account numbers. The hackers employed a common extortion tactic, giving the banks six days before publicly releasing the stolen data unless a ransom was paid. Citizens Bank, a subsidiary of Citizens Financial Group, operates across 14 states and Washington, D.C., serving customers in the Northeast, Mid-Atlantic, and Midwest. National class action law firm Edelson Lechtzin LLP has launched an investigation into potential legal claims on behalf of affected individuals, who may face heightened risks of identity theft and fraud. The firm is offering free case evaluations to those who received breach notifications from Citizens Bank. The incident underscores the growing threat of ransomware attacks targeting financial institutions, with cybercriminals increasingly leveraging stolen data for extortion. No further details on the breach’s origin or the banks’ response have been disclosed.