Sefas Data Breach Exposes Millions of Bank Customers’ Personal Information In December 2025, Sefas Innovation Inc., a provider of customer-management software to enterprise clients, suffered a data breach allegedly orchestrated by Russian cybercriminals. The attack compromised the personal information of millions of customers from Frost Bank and Citizens Bank. A proposed class-action lawsuit against Sefas has moved forward after a U.S. District Court judge in Massachusetts ruled that the plaintiffs affected bank customers had sufficient standing to pursue claims. The lawsuit alleges negligence and breach of third-party beneficiary contract, arguing that Sefas failed to adequately safeguard sensitive data. The breach highlights growing cybersecurity risks for third-party vendors handling financial data, with potential long-term consequences for affected individuals and institutions. Legal proceedings are ongoing as the case progresses.