What Happened to Citizens Bank Data Breaches and Security Incidents?

The term 'Citizens Bank data breach' refers to a series of distinct security incidents affecting different financial institutions operating under the 'Citizens Bank' name, with the most recent and prominent event involving Citizens Financial Group, N.A.

In April 2026, Citizens Financial Group, a major U.S. bank, became the subject of a high-profile data security incident. The Everest ransomware group publicly claimed responsibility, listing Citizens Bank on its dark web leak site on April 20, 2026, and alleging the exfiltration of approximately 3.4 million records. The group also issued a six-day ultimatum for the banks to pay a ransom before publicly releasing the stolen data. Citizens Financial Group confirmed an 'incident involving data extracted from a third-party vendor' by a known threat actor. The bank clarified that 'most of this was masked test data, although a very limited set of customer information was involved,' and asserted there was 'no evidence of unauthorized access to the Citizens network' itself. Despite the bank's assurances, multiple class-action lawsuits were filed against Citizens Bank on April 22, 2026, alleging negligence and failure to protect sensitive personal and financial information, including names, addresses, and account numbers.

Prior to this, in December 2024, Citizens Financial Group had notified 8,358 consumers about a data breach attributed to 'insider wrongdoing.' This incident reportedly exposed sensitive information such as account numbers, Social Security numbers, dates of birth, and other identification details. Additionally, in March 2025, Citizens Bank (Johnston, RI, referring to Citizens Financial Group) reported a smaller 'inadvertent disclosure' affecting 12 individuals, which involved names and other personal identifiers.

Separately, 'The Citizens Bank,' a community bank based in Olanta, South Carolina, experienced its own data breach in June 2025. The bank discovered suspicious activity in its email environment between June 12 and June 14, 2025. An investigation revealed that unauthorized parties may have accessed or potentially accessed files containing extensive sensitive information, including Social Security numbers, financial account information, payment card information, driver's license numbers, taxpayer identification numbers, medical information, and passport numbers. The bank offered complimentary credit monitoring services to affected individuals.

Another distinct entity, 'Citizens Bank of West Virginia,' reported a data breach in November 2023. The bank discovered on November 27, 2023, that an unauthorized third party had accessed its network through a trusted vendor connection between November 15 and November 27, 2023, and acquired certain files. This incident affected 35,105 victims, with compromised data including full names, Social Security numbers, addresses, and driver's license numbers. Law enforcement was notified, and the threat actor group responsible was reportedly disrupted.

The recurring theme across several of these incidents, particularly the major April 2026 event, is the compromise of third-party vendors, highlighting a significant vulnerability in the financial sector's supply chain security. While Citizens Financial Group has emphasized that its internal networks were not directly breached in the 2026 incident, the reliance on external service providers remains a critical point of exposure for sensitive customer data. The ongoing legal actions and the threat of public data release underscore the severe consequences and reputational damage associated with such breaches.