Citizens Financial Group said on April 21, 2026 that it was managing an incident involving data extracted from a third-party vendor. The bank emphasized that there was no evidence of unauthorized access to the Citizens network and that operations continued normally.
Citizens described most of the extracted material as masked test data, while acknowledging that a limited set of information for a small number of customers was involved. Reporting also noted Everest ransomware claims about a much broader dataset, but those claims were not verified in the bank statement.
Canonical record: Citizens Financial Group 2026 vendor incident on BreachHistory.
Source: InvestmentNews