Citizens Bank Data Breach Exposes Customer Information in Vendor-Related Incident Citizens Bank, NA, a major U.S. financial institution and subsidiary of Citizens Financial Group, recently disclosed a data breach affecting hundreds of customers. The incident, reported to the Massachusetts Attorney General on April 28, 2026, stemmed from a security compromise in a third-party vendor’s systems, leading to the exposure of sensitive customer data. The breach impacted 428 individuals in Massachusetts, with exposed information including names, addresses, and financial account numbers specifically those printed on checks. Citizens Bank, founded in 1828 and headquartered in Providence, Rhode Island, offers retail and commercial banking services nationwide. Class action law firm Shamis & Gentile P.A. is investigating the breach and potential compensation for affected customers. The incident highlights ongoing risks tied to third-party vendor vulnerabilities in the financial sector.

Citizens Bank Hit by Ransomware Attack, 3.4 Million Records Exposed On April 20, 2026, the Everest ransomware gang listed Citizens Bank, N.A. on its dark web leak site, claiming to have stolen approximately 3.4 million customer records. The breach, which also affected Texas-based Frost Bank, involved sensitive financial data, including names, home addresses, and account numbers. The hackers employed a common extortion tactic, giving the banks six days before publicly releasing the stolen data unless a ransom was paid. Citizens Bank, a subsidiary of Citizens Financial Group, operates across 14 states and Washington, D.C., serving customers in the Northeast, Mid-Atlantic, and Midwest. National class action law firm Edelson Lechtzin LLP has launched an investigation into potential legal claims on behalf of affected individuals, who may face heightened risks of identity theft and fraud. The firm is offering free case evaluations to those who received breach notifications from Citizens Bank. The incident underscores the growing threat of ransomware attacks targeting financial institutions, with cybercriminals increasingly leveraging stolen data for extortion. No further details on the breach’s origin or the banks’ response have been disclosed.