Citizens Bank Hit by Ransomware Attack, 3.4 Million Records Exposed On April 20, 2026, the Everest ransomware gang listed Citizens Bank, N.A. on its dark web leak site, claiming to have stolen approximately 3.4 million customer records. The breach, which also affected Texas-based Frost Bank, involved sensitive financial data, including names, home addresses, and account numbers. The hackers employed a common extortion tactic, giving the banks six days before publicly releasing the stolen data unless a ransom was paid. Citizens Bank, a subsidiary of Citizens Financial Group, operates across 14 states and Washington, D.C., serving customers in the Northeast, Mid-Atlantic, and Midwest. National class action law firm Edelson Lechtzin LLP has launched an investigation into potential legal claims on behalf of affected individuals, who may face heightened risks of identity theft and fraud. The firm is offering free case evaluations to those who received breach notifications from Citizens Bank. The incident underscores the growing threat of ransomware attacks targeting financial institutions, with cybercriminals increasingly leveraging stolen data for extortion. No further details on the breach’s origin or the banks’ response have been disclosed.

Sefas Data Breach Exposes Nearly 200,000 Frost Bank Customers Global software vendor Sefas disclosed a data security incident that compromised sensitive personal information of 191,848 Frost Bank customers. The breach, detected on April 16, 2026, involved unauthorized access to an SFTP server used for software support, with attackers downloading files containing customer data between December 2025 and April 2026. The exposed data included names, addresses, Social Security numbers, taxpayer IDs, account numbers, dates of birth, and loan numbers. Sefas confirmed the breach was contained to the SFTP server and ceased after April 16, with no evidence of further compromise. Frost Bank was notified on April 22, 2026, and the incident was reported to Texas state regulators. Separately, the Everest ransomware gang claimed responsibility for exfiltrating 250,000 Social Security numbers from Frost Bank, listing the bank on its dark web leak site in April 2026. The group did not disclose ransom demands or payment status, and Frost Bank has not publicly responded to the claims. Sefas has offered affected individuals one year of complimentary identity protection and credit monitoring through CyberScout. The investigation, supported by external cybersecurity experts, remains ongoing.

Cullen/Frost Bankers Data Breach Exposes Sensitive Information of Nearly 4,700 Individuals Cullen/Frost Bankers, Inc., a Texas-based financial holding company and parent of Frost Bank, recently disclosed a data breach affecting 4,698 individuals in the U.S. The incident was reported to the U.S. Department of Health and Human Services on March 26, 2026, though the company has not publicly revealed the cause or specifics of the breach. Founded in 1868 and headquartered in San Antonio, Cullen/Frost Bankers provides commercial and consumer banking, international banking, and wealth management services. Current and former clients of the bank may have had sensitive personally identifiable information (PII) compromised in the incident. Class action law firm Shamis & Gentile P.A. is investigating the breach and potential legal claims for affected individuals. Those impacted may be eligible for compensation as part of ongoing legal efforts.