Citizens Bank data exposed: here’s what customers need to know
The bank is urging customers to stay vigilant.
Image by Plat-Q via Shutterstock
Follow us
- Citizens Bank says an unauthorized third party accessed customer data, including names, SSNs, birth dates, emails, and phone numbers.
- The bank says it has no evidence the data was misused and has remediated the issue.
- Affected customers get two years of credit monitoring and identity protection.
- This is Citizens Bank's second cyber incident in 2026, after an April breach involving a third-party vendor.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Citizens Bank has warned customers about a new data breach. No evidence the data was exploited, at this point in investigation.
Citizens, one of the largest banks in the United States, has notified customers that an unauthorized third party gained access to a system containing personal information.
Citizens Bank says it identified the security incident on September 10th, 2026, when an unauthorized party accessed customers’ sensitive data, including Social Security numbers.
What Citizens Bank data was breached?
- Names
- Social Security numbers (SSNs)
- Date of Births
- Phone numbers
- Email addresses
Exposing this type of information puts Citizens Bank customers at risk of social engineering attacks. By exploiting stolen personal data, attackers can craft convincing phishing messages that trick customers into clicking malicious links and revealing even more sensitive data.
Meanwhile, Social Security numbers and dates of birth are particularly sensitive because, unlike passwords, they’re not easily replaced. SSNs are often sold on underground marketplaces along with other sensitive data, revealing identities.
Citizens Bank did not reveal how many people may have been impacted. We have reached out for clarification and will update once we receive a reply.
“We have found no evidence that any customer data was examined or used maliciously, and the issue has been fully remediated,” the bank said in the notice.
Still, the bank is offering affected customers 2 years of credit monitoring and identity protection.
“Remain vigilant against threats of identity theft or fraud by regularly reviewing and monitoring your account statements and credit history for any signs of unauthorized transactions or activity,” the bank advised.
Second data breach in a year
This is the second cyber incident Citizens Bank has suffered this year. In April, Cybernews reported that the Everest ransomware gang targeted the Citizens Bank, claiming to have exfiltrated 3.4 million customer records.
The stolen data included full names, home addresses, account numbers, and internal document flags.
At the time, the bank confirmed the breach, saying that data was extracted from a third-party vendor.
