What happened in the Citizens data breach?

Citizens has notified affected customers about a data security incident involving unauthorized access to personal information. According to its notification letter, the bank identified an issue on September 10, 2026, that allowed an unauthorized third party to access some data. The information involved included customers’ names, Social Security numbers, dates of birth, phone numbers, and email addresses. Source: Citizens California Submitted Breach Notification Sample

The public notice provides limited information about how the Citizens data breach happened. It does not identify the unauthorized party, describe the affected system, or explain the technical issue that permitted access. It also does not disclose when the exposure began or how long it lasted. Although California’s register lists September 10, 2026, as the breach date, Citizens’ letter describes that date as the day the bank identified the issue. Source: Citizens California Submitted Breach Notification Sample

Citizens states that the issue has been fully remediated. The bank also says it found no evidence that customer data was examined or used maliciously and was not aware of fraud or identity theft involving recipients’ information when it prepared the notice. Those statements describe the bank’s findings; the letter nevertheless notifies customers of unauthorized access and recommends precautions against identity theft and fraud. Source: Citizens California Submitted Breach Notification Sample

California’s Attorney General listed the Citizens breach notification on October 19, 2026. The publicly available sample letter contains a placeholder for the mailing date, so it does not establish the exact date individual notifications were sent. Neither the California filing nor the sample letter provides a nationwide affected population or an exact California resident count. Source: Citizens California Submitted Breach Notification Sample

Citizens is offering affected customers two years of complimentary Equifax Credit Watch Gold credit monitoring and identity protection services. The enrollment materials describe Equifax credit report monitoring, identity restoration assistance, internet monitoring for certain personal information, and up to $1 million in identity theft insurance for eligible expenses, subject to policy terms and exclusions. Recipients must enroll using the activation code and deadline in their individual notification materials. Source: Citizens California Submitted Breach Notification Sample

How did the Citizens data breach occur?

The Citizens data breach involved an issue that allowed an unauthorized third party to access personal information. Citizens identified the issue on September 10, 2026, and states that it has been fully remediated. The public notice does not explain the access method, identify the responsible party, or establish whether the incident involved a software vulnerability, configuration error, stolen credentials, or another cause. Source: Citizens California Submitted Breach Notification Sample

When did the Citizens data breach occur?

Citizens identified the issue on September 10, 2026. Although California’s register lists that date under the breach date field, the bank’s letter does not disclose the first date of unauthorized access or the exposure’s duration. California listed the notification on October 19, 2026; the sample letter does not provide an actual mailing date. Source: Citizens California Submitted Breach Notification Sample

How many people were affected by the Citizens data breach?

A verified nationwide total and exact state counts have not been made public for this incident as of October 19, 2026. The California filing does not specify how many residents were affected. California generally requires submission of a sample notice when more than 500 residents are notified, making the posting consistent with that reporting threshold; however, the threshold should not be presented as a Citizens-confirmed count.

What information was exposed in the Citizens data breach?

• Breached data reportedly may include, but is not necessarily limited to:
  • name
  • date of birth
  • Social Security number
  • phone numbers
  • email addresses
  Affected customers should review their own notification carefully and ask Citizens to clarify any uncertainty about which information was involved in their particular case. The public notice does not list account numbers, payment card numbers, PINs, or online banking passwords among the affected information. It also does not say that information was publicly posted or sold. Citizens reports no evidence that customer data was examined or used maliciously, but it still recommends monitoring financial accounts and credit history for suspicious activity. Source: Citizens California Submitted Breach Notification Sample

Has Citizens offered free credit monitoring and/or identity theft protection services?

Yes. Citizens is offering affected customers a complimentary two-year Equifax Credit Watch Gold membership. The service includes Equifax credit monitoring, identity restoration assistance, and other identity protection features, including up to $1 million in insurance for certain identity theft expenses, subject to coverage terms. The enrollment materials state that participants must be over 18 and have a credit file. Recipients should follow their individual enrollment instructions and deadline. Source: Citizens California Submitted Breach Notification Sample

Citizens Data Breach Timeline

Date	Event
Date Not Disclosed	Unauthorized activity began.
September 10, 2026	Citizens identified an issue allowing an unauthorized third party to access some personal information.
Date Not Disclosed	Unauthorized activity ended.
Date Not Disclosed	Citizens remediated the issue. Its notification states that remediation was complete but does not give a completion date.
Individual enrollment deadline	Eligible recipients must activate the complimentary two-year Equifax membership by the deadline in their own notice. The public sample leaves that date blank.

Who is Citizens?

Citizens is a U.S. banking business that includes Citizens Bank, N.A., and its parent company, Citizens Financial Group, Inc., which is headquartered in Providence, Rhode Island. Its services include checking and savings accounts, credit cards, mortgages, student loans, business financing, private banking, and wealth management. Citizens serves individuals, families, businesses, and institutional clients through branches, ATMs, online banking, and mobile banking. Its commercial banking operations also provide lending, treasury management, corporate finance, and capital markets services. Sources: Citizens Website -- Our Company; Citizens Financial -- Latest News

What should you do if you received a Citizens data breach letter?

• • Read and keep the notification. Save the letter, enrollment instructions, and any related communications. Review the information identified as affected and the deadline for activating protection services. For questions about this incident, Citizens lists 1-866-950-8157, with hours stated as Monday through Friday, 7 a.m. to 10 p.m. EST, and weekends, 9 a.m. to 6 p.m. EST. Source: Citizens California Submitted Breach Notification Sample
  • Activate the complimentary protection services. Eligible recipients can enroll in two years of Equifax Credit Watch Gold using the unique activation code in their notice at Equifax. Complete enrollment before the deadline printed in the individual letter, then review alerts and use identity restoration assistance if needed.
  • Consider freezing credit at all three major bureaus. Because Social Security numbers were involved, a credit freeze is a useful precaution against someone opening new credit accounts using exposed information. Freezes are free and must be placed separately with Equifax, Experian, and TransUnion. The Equifax report lock included with the offered service does not protect credit files at the other bureaus. FTC: Credit Freezes and Fraud Alerts
  • Consider a fraud alert. An initial fraud alert tells lenders to take additional steps to verify identity before granting new credit. It is free, lasts one year, and can be renewed. Contacting one of the three major credit bureaus is sufficient because that bureau must notify the other two. A fraud alert can also be used alongside a credit freeze. FTC: Credit Freezes and Fraud Alerts
  • Review credit reports and financial accounts. Obtain free credit reports through AnnualCreditReport.com and check for unfamiliar accounts, credit inquiries, or inaccurate information. Free reports are available weekly from each of the three major bureaus. Also review bank and card statements, since credit monitoring does not replace checking existing accounts for unauthorized transactions. Report suspicious activity to Citizens promptly.
  • Watch for convincing emails, texts, and calls. Scammers may use personal details to impersonate a bank or another trusted organization. Verify unexpected requests through a known official website or phone number. Avoid sending sensitive information through unsolicited messages, and enable multifactor authentication on financial and email accounts where available. FTC: How To Recognize and Avoid Phishing Scams
  • Act promptly if identity theft appears. Notify the affected financial institution, dispute unauthorized accounts or transactions, and report identity theft at IdentityTheft.gov to obtain a recovery plan. Citizens also advises reporting suspicious activity to the bank and contacting local police when appropriate. Keep copies of reports, correspondence, and records of related expenses. IRS Identity Theft Guide Central

Citizens Data Breach Notice

The notice describes the Citizens data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Citizens Data Breach Notice in a New Tab

Sources & Additional Information About the Citizens Data Breach

• • Citizens Website
  • Citizens California Submitted Breach Notification Sample
  • FTC: How To Recognize and Avoid Phishing Scams
  • my Social Security
  • Medicare.gov: Reporting Medicare fraud & abuse
  • FTC: Checking Your Credit Report
  • FTC: Credit Freezes and Fraud Alerts
  • AnnualCreditReport.com
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • IRS Identity Theft Guide Central
  • IRS: Get an identity protection PIN (IP PIN)
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Citizens data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Citizens data breach, Citizens data breach notice, Citizens class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Citizens or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.