TL;DR: The Citizens Bank data breach disclosed this week exposed customers’ names, Social Security numbers, dates of birth, phone numbers and email addresses. Citizens says it found the problem on September 10, 2026, that an unauthorized third party could access some data, and that the issue “has been fully remediated.” The bank says it has no evidence the data was examined or misused. It hasn’t said how many people are affected, but its filing with the Texas attorney general reportedly lists 14,371 Texans. Affected customers get two years of free Equifax Credit Watch Gold. Because Social Security numbers were involved, the most useful step is a free credit freeze at Equifax, Experian and TransUnion. This is a separate incident from the April 2026 vendor breach at Citizens.
Last updated: October 21, 2026. By Veer. Facts checked against the Citizens Notification of Data Breach sample letter and listing on the California attorney general’s site, Citizens’ April 21, 2026 statement, its April letter filed with Massachusetts, Citizens’ contact page, reporting by Cybernews, teiss and the Boston Globe, and guidance from the FTC and IRS. This is a researched explainer. We haven’t enrolled in the services described below.
What happened in the Citizens Bank data breach?
The Citizens Bank data breach is an incident in which an unauthorized outsider was able to reach a Citizens system holding customer personal information. In its notification letter, Citizens says that “on September 10, 2026, Citizens identified an issue that allowed some data to be accessed by an unauthorized third-party.”
The letter is short on detail. It doesn’t say when the access started, which system was involved, whether it was a hacker, a misconfiguration or an insider, or how many customers are affected. The California listing gives the date of the breach as Thursday, September 10, 2026. teiss reports that the sample notice was dated October 19.
Citizens’ own reassurance is worded strongly: “We have found no evidence that any customer data was examined or used maliciously, and the issue has been fully remediated.” That’s a statement about what Citizens has found so far. It isn’t a guarantee that nobody copied the data, which is why the bank is still offering identity protection.
Which Citizens Bank is this?
Citizens Bank is the bank owned by Citizens Financial Group, headquartered in Providence, Rhode Island, with about 1,000 branches in 14 states and Washington, D.C., according to the Boston Globe. Citizens Financial Group reported $227.9 billion in assets as of March 31, 2026, in its April statement.
Lots of smaller, unrelated US banks use “Citizens” in their names, and so does First Citizens Bank. The October letter is signed “Your Citizens Team” and gives the support line 1-866-950-8157. Citizens Bank, N.A. used the same number in the April breach letter it filed with Massachusetts. If your bank is a different “Citizens,” this notice isn’t about you.
What information was exposed?
The October letter lists five data types: name, Social Security number, date of birth, phone number and email address. It doesn’t mention account numbers, card numbers, online banking passwords or PINs, and it doesn’t mention home addresses. The letter itself was mailed to customers’ homes, though, so Citizens clearly has those on file.
| Data type | In the October 2026 letter? | Why it matters |
|---|---|---|
| Full name | Yes | Lets scammers address you personally |
| Social Security number | Yes | Can be used to open new credit, file fake tax returns or pass ID checks |
| Date of birth | Yes | A common identity check, and it can’t be changed |
| Phone number | Yes | Scam calls and texts pretending to be Citizens |
| Email address | Yes | Phishing emails that look like bank notices |
| Bank account or card numbers | Not listed | Ask Citizens directly if you’re worried |
| Online banking password or PIN | Not listed | Still worth changing if you reuse it elsewhere |
A name, Social Security number and date of birth together are the core of most US identity checks. Unlike a card number, you can’t cancel and reissue a Social Security number. That’s why this incident is more serious than Citizens’ April breach, even if fewer people turn out to be affected.
How many people are affected?
Citizens hasn’t published a total. The California sample letter doesn’t give a number, and Cybernews says the bank didn’t say how many people may have been impacted.
One partial figure has surfaced. The law firm Levi & Korsinsky, which says it’s investigating the breach, reports that Citizens’ report to the Texas attorney general, published October 20, 2026, lists 14,371 Texans among those affected. The breach tracker Claim Depot reports the same Texas figure. We couldn’t load the Texas portal entry directly, because the site loads its table with JavaScript. Because the Texas figure covers only Texas residents, the national total is almost certainly higher. We’ll update this post if Citizens or a state regulator publishes a full count.
Is this the same as the April 2026 Citizens breach?
No. The October notice describes a separate, second incident. In April, Citizens dealt with a breach at one of its outside vendors. In October, the letter describes an issue that let a third party access Citizens data and doesn’t mention a vendor.
| April 2026 incident | October 2026 incident | |
|---|---|---|
| What Citizens said happened | “Data extracted from a third party vendor” (April 21 statement) | An issue “allowed some data to be accessed by an unauthorized third-party” (letter) |
| Date identified | Disclosed April 21, 2026 | September 10, 2026 |
| Data involved | “Data that is typically on written checks – name, address, and account number” (Citizens spokesperson to the Boston Globe) | Name, Social Security number, date of birth, phone, email |
| Social Security numbers | Not included, per Citizens (teiss) | Included |
| Scale | “A few thousand customers,” per Citizens; the Everest extortion group claimed 3.4 million records (Cybernews) | Not disclosed; 14,371 Texans, per reports of the Texas filing |
| Free monitoring | 2 years Equifax Credit Watch Gold, enroll by April 30, 2027 (Massachusetts letter) | 2 years Equifax Credit Watch Gold, deadline printed in each letter |
In April, Citizens said “most of this was masked test data, although a limited set of information for a small number of customers was involved,” and that there was “no evidence of unauthorized access to the Citizens network.” A Citizens spokesperson told the Boston Globe that masked data replaces real names, account numbers and Social Security numbers with “realistic but fake values.” Two class action lawsuits followed within days, the Globe reported.
If you got a letter in April and another one now, you’re probably in both incidents. Each letter comes with its own activation code.
What should Citizens customers do now?
If you got the October letter, freeze your credit, enroll in the free monitoring and treat every “Citizens” call, text or email with suspicion. If you’re a Citizens customer without a letter, a credit freeze is still a sensible, free precaution. The FTC says “you don’t have to wait for your Social Security number or other information to be exposed in a data breach” to freeze your credit.
1. Freeze your credit at all three bureaus
A credit freeze stops anyone, including you, from opening new credit in your name until you lift it. According to the FTC, a freeze is free, doesn’t affect your credit score and lasts until you lift it. You have to request it separately at Equifax, Experian and TransUnion.
- Set up a freeze online at each bureau’s website, or by phone: Equifax 1-877-478-7625, Experian 1-888-397-3742, TransUnion 1-800-680-7289 (numbers as printed in the Citizens letter).
- Save the login or PIN each bureau gives you. You’ll need it to lift the freeze later.
- When you apply for a loan, card, apartment or job, ask which bureau the lender uses and lift the freeze only there, then put it back. The FTC recommends exactly that approach.
The Citizens letter also lists a fourth agency, Innovis (1-800-540-2505). The FTC’s guidance names only the big three, but freezing at Innovis too is free and doesn’t hurt.
2. Enroll in the free Equifax Credit Watch Gold
Citizens is paying for two years of Equifax Credit Watch Gold. The letter says it includes:
- Monitoring of your Equifax credit report with email alerts, plus daily access to that report
- WebScan alerts if your Social Security number or card or account numbers turn up on “fraudulent Internet trading sites”
- Automatic fraud alerts and an Equifax credit report lock
- Identity restoration help from a dedicated specialist
- Up to $1,000,000 in identity theft insurance for certain out-of-pocket costs
To enroll, go to equifax.com/activate, enter the activation code printed in your letter and follow the four steps (register, create an account, verify your identity, check out). You must be over 18 with a credit file. Check the enrollment deadline printed on your letter. The sample doesn’t show a date.
Keep in mind what this service doesn’t do. Credit Watch Gold watches Equifax only, and the letter itself says the Equifax lock “will not prevent access to your credit report at any other credit reporting agency.” The freezes in step 1 cover all three bureaus.
3. Get an IRS Identity Protection PIN
With your Social Security number and birth date out there, someone could try to file a fake tax return in your name and claim your refund. An IRS Identity Protection PIN (IP PIN) is “a six-digit number that prevents someone else from filing a tax return using your Social Security number,” according to the IRS.
Anyone with a Social Security number who can verify their identity can get one. The fastest way is the IP PIN section of your IRS online account. An IP PIN is valid for one calendar year, and a new one is generated each year. The IRS says it “will never ask for your IP PIN,” so any call, email or text asking for it is a scam.
4. Treat every “Citizens” call, text and email as suspect
The breach exposed exactly what a scammer needs to impersonate the bank: your name, phone number and email address, plus details like your birth date that make a fake call sound real. Expect messages saying your account is locked, that there’s fraud on your card or that you need to “verify” your identity after the breach.
- Don’t click links or call numbers in unexpected texts or emails. Use the Citizens app, or type the website address yourself.
- To check whether a call or letter is real, call the number on the back of your card or Citizens’ main line, 1-800-922-9999, listed on its contact page. Citizens’ fraud line is 1-800-974-2260.
- Citizens’ breach support line, 1-866-950-8157, is open Monday to Friday 7 a.m. to 10 p.m. ET and weekends 9 a.m. to 6 p.m. ET, per the letter.
- Never read out a one-time passcode sent to your phone. A real bank employee won’t ask for it.
If you still use text-message codes to sign in, our guide to whether SMS two-factor authentication is safe explains why an authenticator app or passkey holds up better once your phone number is in a breach.
5. Watch your statements and credit reports
The Citizens letter says to stay vigilant for the next 12 to 24 months. Check your Citizens and other bank and card statements every week or two, and pull free credit reports at annualcreditreport.com, the only official site for them, according to the letter. Look for accounts you didn’t open and credit checks you didn’t request.
6. Place a fraud alert if you can’t freeze yet
If you need credit soon and don’t want to freeze, a fraud alert is a lighter option. It tells lenders to verify your identity before opening new credit. Per the FTC, an initial fraud alert is free, lasts one year and only needs a request at one bureau, which must tell the other two. If your identity has already been misused, report it at IdentityTheft.gov. An FTC report or police report lets you place an extended fraud alert that lasts seven years.
How do I know if I’m affected?
You’re affected if you receive a letter titled “Notification of Data Breach from Citizens.” The sample letter on the California site came from a “Secure Processing Center” at P.O. Box 680, Central Islip, NY, and includes a personal activation code.
If you’re not sure whether a letter or email is genuine, don’t use the phone number or link in it to check. Call Citizens on 1-800-922-9999 or the number on your card and ask whether you’re part of the September 10 incident. If you haven’t received anything, Citizens hasn’t said whether notices are still going out. A credit freeze is still a sensible step if you’re a long-time customer.
Is there a Citizens Bank data breach lawsuit?
Not yet for the October incident, as far as we can find. Law firms including Levi & Korsinsky say they’re investigating whether affected customers are entitled to compensation. That usually comes before a class action is filed. A CourtListener search on October 21 found no federal case tied to the October notice yet. The April vendor incident led to two class actions within days, according to the Boston Globe.
You don’t need to sign up with a law firm to protect yourself. If a lawsuit later settles, claim instructions are normally sent to people on the notice list.
How does this compare with other recent breaches?
Like the ETS breach that exposed millions of California students’ records, Citizens’ notice gives a discovery date and free monitoring but little detail about how the attackers got in. The difference is the data. ETS says no Social Security numbers were taken, while Citizens confirms they were. That makes the freeze and the IRS IP PIN much more important here. When grocery chains went offline in the Stop & Shop cyber attack earlier this month, fake “verify your account” texts followed the headlines, and the same pattern is likely now.
Citizens Bank data breach timeline
| Date (2026) | Event |
|---|---|
| April 21 | Citizens confirms an incident involving “data extracted from a third party vendor”; mostly masked test data, a small number of customers |
| April 24 | Boston Globe reports “a few thousand” customers affected and two class actions filed |
| September 10 | Citizens identifies a new issue that allowed an unauthorized third party to access customer data |
| October 19 | Sample “Notification of Data Breach” letter listed on the California attorney general’s site |
| October 20 | Texas attorney general listing published showing 14,371 affected Texans (per Levi & Korsinsky and Claim Depot); Cybernews and teiss report the breach |
| October 21 | No total count, cause or lawsuit for the October incident published yet |
FAQ
What is the Citizens Bank data breach?
The Citizens Bank data breach is an incident Citizens identified on September 10, 2026, in which an unauthorized third party was able to access some customer data. The data included names, Social Security numbers, dates of birth, phone numbers and email addresses. Citizens says the issue has been fully remediated.
Were Social Security numbers stolen in the Citizens Bank breach?
Citizens’ letter lists Social Security numbers among the data an unauthorized third party could access. Citizens says it has found no evidence the data was examined or used maliciously, but it is offering two years of identity protection, and a credit freeze is the safest response.
How many Citizens Bank customers were affected?
Citizens hasn’t published a total. Its filing with the Texas attorney general lists 14,371 Texans, according to Levi & Korsinsky and Claim Depot. That figure covers Texas residents only, so the national total is almost certainly higher.
How do I sign up for the free Citizens credit monitoring?
Go to equifax.com/activate and enter the activation code printed in your Citizens letter. Then register, create an account, verify your identity and click Sign Me Up. You must be over 18 with a credit file and enroll by the deadline printed in your letter.
Is this the same as the April 2026 Citizens breach?
No. The April incident involved data taken from a Citizens vendor, mostly masked test data plus check details for a few thousand customers, and no Social Security numbers. The October notice describes a separate incident, identified September 10, 2026, that did involve Social Security numbers.
Should I close my Citizens Bank account?
The October letter doesn’t list account or card numbers, so closing your account isn’t the main fix. Freezing your credit at Equifax, Experian and TransUnion protects you against new accounts opened with your Social Security number. Turn on account alerts and call Citizens on 1-800-922-9999 if you see anything you don’t recognize.
Sources
- Citizens: Notification of Data Breach (sample letter, California attorney general) (dated October 19, 2026, per teiss)
- California Department of Justice: Submitted Breach Notification Sample, Citizens Bank (date of breach September 10, 2026)
- Citizens: Statement Regarding Third-Party Vendor Event (April 21, 2026)
- Massachusetts OCABR: Citizens Bank, N.A. breach notice 2026-655 (April 2026 vendor incident letter)
- Citizens: Customer Service contact page (checked October 21, 2026)
- Cybernews: Citizens Bank data breach exposes SSNs in second 2026 incident (October 20, 2026)
- teiss: Citizens Bank notifies customers of data breach involving social security numbers (October 20, 2026)
- Boston Globe: Class action lawsuits filed after Citizens Bank data breach (April 24, 2026)
- Levi & Korsinsky: Citizens Bank breach investigation (Texas filing figure)
- Claim Depot: Citizens Bank data breach (updated October 20, 2026)
- FTC: Credit Freezes and Fraud Alerts
- IRS: Get an Identity Protection PIN (last reviewed August 4, 2026)
