Citizens Bank has begun notifying customers about a security incident involving sensitive personal information, including Social Security numbers and dates of birth. The disclosure comes months after the US financial institution was linked to a separate data breach involving one of its third-party service providers.
The latest incident was identified on September 10, 2026, when the bank discovered an issue that allowed an unauthorized third party to access customer information. A breach notification submitted to the California Attorney General’s Office on October 19 provides details about the potentially compromised records.
According to the notice, the information accessible to the unauthorized party included customer names, Social Security numbers, dates of birth, telephone numbers, and email addresses. The bank has not disclosed how many individuals were affected or explained how the security weakness was exploited.
Citizens Bank said it had addressed the issue and found no evidence that customer information had been examined or used for malicious purposes. The institution also reported that it was unaware of any identity theft or fraud directly associated with the incident.
Despite those findings, the exposure of Social Security numbers and other identifying details creates potential risks for affected customers. Such information can be exploited in identity theft schemes, fraudulent account applications, and phishing attempts designed to impersonate legitimate financial institutions.
As a precaution, Citizens Bank is offering affected individuals two years of complimentary credit monitoring and identity protection through Equifax Credit Watch Gold. The service includes credit activity alerts, identity restoration assistance, and insurance coverage for certain identity theft-related losses.
Customers receiving notification letters have been encouraged to review their financial statements and credit reports for suspicious activity. The bank has also provided instructions for placing fraud alerts or security freezes with major credit reporting agencies.
The disclosure follows an earlier incident reported in April 2026, when the Everest ransomware group claimed to possess approximately 3.4 million records associated with Citizens Financial Group. At the time, the bank confirmed that information had been extracted from a third-party vendor rather than its own network.
Citizens Financial Group said most of the earlier dataset consisted of masked test information, with only a limited amount of actual customer data involved. The company also stated that the exposed records did not contain Social Security numbers.
There is currently no evidence connecting the September incident to the earlier vendor breach. The identity of the individual or group responsible for the latest unauthorized access remains unknown, and the total number of affected customers has not been publicly established.