Citizens Bank Data Breach

An outside party accessed Citizens Bank customer data, including Social Security numbers and dates of birth. Citizens found the problem on September 10, 2026, but notices did not appear with state regulators until mid-October.

What Happened at Citizens Bank

Citizens Bank, N.A. is the bank arm of Citizens Financial Group, based in Rhode Island. According to its Notification of Data Breach letter, Citizens identified an issue on September 10, 2026 that “allowed some data to be accessed by an unauthorized third-party.” Citizens says the issue has been fully remediated, meaning fixed. The letter does not explain what the issue was or how the outside party got in.

Citizens filed a sample of its letter with the California Attorney General, which posted it on October 19, 2026. On October 20, 2026, the Texas Attorney General listed the incident as affecting 14,371 Texans, with notice sent by U.S. Mail.

Citizens states that it has “found no evidence that any customer data was examined or used maliciously.” That statement does not mean the risk is gone. Stolen identity data can be sold or used months or years after a breach.

Why the 39-Day Gap and the Data Mix Matter

Citizens found the issue on September 10. The California filing did not appear until October 19, 39 days later. The sample letter leaves its date blank, so the exact mailing date is not public. Citizens has not explained the timing.

The type of data matters even more. A Social Security number paired with a full name and date of birth is the core of most identity checks. Criminals can use that combination to open new credit cards, apply for loans or file false tax returns. The phone numbers and email addresses in the letter also give scammers a direct way to reach affected customers.

This is not the first incident Citizens has disclosed this year. In April 2026, Citizens announced a separate incident at a third-party vendor (an outside company that works for the bank). That April event involved different data and is a different matter from the September incident.

Citizens has not disclosed the total number of people affected. The Texas count of 14,371 is a floor, not a total. California posts a notice only when more than 500 of its residents are affected, so at least that many Californians likely received letters as well.

Sources: California Attorney General breach listing and sample letter; Texas Attorney General Data Security Breach Reports; Citizens newsroom statement, April 21, 2026.

What Information Was Exposed?

Based on the official notice letter, the information involved includes:

• Names
• Social Security numbers
• Dates of birth
• Phone numbers
• Email addresses

The Texas Attorney General listing also includes addresses.

What Is Citizens Bank Offering Affected Customers?

Citizens is offering a complimentary two-year membership in Equifax Credit Watch Gold, a credit monitoring service. Customers enroll at equifax.com/activate using the activation code printed in their letter. The enrollment deadline is also printed in each letter; the sample letter on file with California leaves that date blank. Questions go to Citizens at 1-866-950-8157.

Your Information Is at Risk

Unlike a credit card number, a Social Security number cannot easily be changed. Affected individuals face a lasting risk of new-account fraud, tax fraud and targeted phishing (fake emails or texts designed to trick people into sharing more information). Scammers often mention a real breach by name to seem believable.

Affected individuals should:

• Enroll in the Equifax monitoring before the deadline in the letter
• Place a free fraud alert or a security freeze with Equifax, Experian and TransUnion
• Review bank statements and free credit reports at annualcreditreport.com
• Treat unexpected calls, texts or emails about Citizens accounts with caution
• Report identity theft to the FTC at IdentityTheft.gov

Do You Have Legal Options?

Banks collect Social Security numbers and other sensitive data from their customers, and they have a legal obligation to safeguard it. When that obligation is not met, affected individuals may have legal rights and remedies. Emery | Reddy is investigating the Citizens Bank data breach on behalf of affected customers.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Citizens Bank data breach?

Citizens has not disclosed a total. The Texas Attorney General lists 14,371 Texans. Citizens also filed notice in California, which happens only when more than 500 California residents are affected. The full number is likely higher.

What information was exposed?

The notice letter lists:

• Names
• Social Security numbers
• Dates of birth
• Phone numbers
• Email addresses

The Texas listing also includes addresses.

Why did it take so long for Citizens to notify people?

Citizens found the issue on September 10, 2026. Its California filing appeared on October 19, 39 days later. Citizens has not explained the gap.

Is this the same as the Citizens Bank incident from April 2026?

No. The April 2026 incident involved a third-party vendor and different data. The September incident is separate. If you got letters about both, keep both.

What should I do if I received a letter?

• Enroll in Equifax Credit Watch Gold before your deadline
• Freeze your credit with Equifax, Experian and TransUnion
• Watch your accounts and credit reports for anything you do not recognize
• Keep your letter and envelope

Could scammers contact me about this breach?

Yes. Criminals often send fake messages that name a real breach. Do not share personal information with anyone who contacts you out of the blue. Call the number on the back of your card or on your letter instead.

Do I have a legal claim?

Banks have a duty to protect your Social Security number and other personal data. If Citizens failed to do that, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.