Citizens Bank has told customers that an unauthorised third party gained access to their personal data, including Social Security numbers and dates of birth. The breach notice, filed with the California Attorney General and first reported by Cybernews, says the bank identified the problem on 10 September 2026.
The data involved is the kind that cannot be changed like a password, which makes it valuable for identity fraud. Citizens says it has found no sign of misuse and has fixed the issue, but it has not said how many people were affected or how the intruder got in. According to Cybernews, it is the bank’s second cyber incident this year.
In brief
- Citizens Bank says an unauthorised third party accessed customers’ names, Social Security numbers, birth dates, phone numbers and email addresses.
- The bank says it found no evidence the data was examined or misused and is offering two years of free credit monitoring.
- It has not disclosed how many people were affected, who was responsible or how they got in.
What the notice says
The letter, headed “Notification of Data Breach from Citizens”, says: “On September 10, 2026, Citizens identified an issue that allowed some data to be accessed by an unauthorized third-party.” It lists the data involved as “Name, Social Security Number, Date of Birth, Phone Number and Email Address.”
The bank sounds a reassuring note. “We have found no evidence that any customer data was examined or used maliciously, and the issue has been fully remediated,” the notice says. It gives no further detail about what the issue was, how long the access lasted or how it was discovered.
The California Attorney General’s list records the date of the breach as 10 September 2026 and the date it was reported as 19 October 2026, more than five weeks later. The notice itself is a template letter and carries no date.
| Detail | What Citizens has disclosed |
|---|---|
| Date identified | 10 September 2026 |
| Reported to California AG | 19 October 2026 |
| Data involved | Name, SSN, date of birth, phone, email |
| People affected | Not disclosed |
Free monitoring, and a warning to stay alert
Citizens is offering affected customers a free two-year membership of Equifax Credit Watch Gold. “Although we are not aware of any instances of fraud or identity theft involving your information, as a courtesy, we are providing a complimentary two-year membership in an identity theft credit monitoring service,” the notice says.
It also asks customers to “Remain vigilant against threats of identity theft or fraud by regularly reviewing and monitoring your account statements and credit history for any signs of unauthorized transactions or activity.” An attached guidance sheet tells them to stay alert “FOR THE NEXT 12 TO 24 MONTHS” and suggests fraud alerts and credit freezes with the main credit reporting agencies.
The number of people affected remains unknown. “Citizens Bank did not reveal how many people may have been impacted,” Cybernews reported, adding that it had asked the bank for clarification.
A second incident this year
The notice follows an earlier incident in April. At that time, Cybernews reported, the Everest ransomware gang claimed to have taken 3.4 million customer records from Citizens. That figure is the gang’s own claim. According to Cybernews, the bank confirmed that breach and said the data had been taken from a third-party vendor.
No source links the September incident to the April one, and Citizens has not said whether a supplier was involved this time. Either way, the notice’s own advice stands: customers should review their statements and credit history closely.
Our read
This is TSN’s analysis. More than five weeks passed between Citizens identifying the issue and the California filing. Without a count of people affected or any explanation of the cause, the notice tells customers what was taken but not how big the problem is. Two incidents in one year will put the bank’s handling of its own systems and its suppliers under closer scrutiny.
Sources
- Citizens: Notification of Data Breach from Citizens (notice filed with the California Attorney General)
- California Attorney General: Submitted Breach Notification Sample (Citizens Bank)
- Cybernews: Citizens Bank data exposed: here’s what customers need to know, 20 October 2026
Related stories
- A Cyber Incident at BAE Systems Has Halted Notices From America’s Federal Bankruptcy Courts
- Hackers Hit Romanian Central Depository’s Investor App, Viewing Personal Data
- Napoleon Perdis Says About 339,055 Customer Records Were Hit in Supplier Breach
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
