2026 Citizens Bank — unauthorized access to customer data incl. SSNs (identified Sep 10; second 2026 incident)
Data compromised
Names, Social Security numbers, dates of birth, phone numbers and email addresses. Number affected not disclosed. Two years of Equifax credit monitoring offered.
Technical writeup
Citizens Bank notice filed with the California Attorney General (sample letter dated Oct 19, 2026): incident identified Sep 10, 2026, when an unauthorized third party accessed a system holding customer data. Citizens says it "found no evidence that any customer data was examined or used maliciously" and has fully remediated the issue; it offers two years of Equifax Credit Watch Gold. Access method and victim count not disclosed. Separate from the April 2026 third-party vendor incident tied to Everest claims (citizens-financial-group-vendor2026). companyConfirmed true; recordsAffected 0 (count not disclosed).
Root cause
Not disclosed. Citizens says an unauthorized third party gained access to a system containing customer personal information; the issue has been remediated.