Customers who receive a Citizens Bank breach letter about an incident identified on September 10, 2026 are being told that their names, Social Security numbers and dates of birth were accessed by an unauthorized third party. No lawsuit or settlement has been reported over this incident, and there is nothing to claim.
No Lawsuit Over This Notice · Nothing to Claim
This article reports a data breach notice and, separately, a pending lawsuit over an earlier incident. Claims in that lawsuit are unproven allegations; no bank has been found liable, no class has been certified, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What Is This About?
On October 19, 2026, a sample data breach notice was posted to the California Attorney General's data breach list under the organization name Citizens Bank. The letter, headed "Notification of Data Breach from Citizens," says that on September 10, 2026, Citizens identified an issue that allowed some data to be accessed by an unauthorized third party. It says the information involved was name, Social Security number, date of birth, phone number and email address. The bank writes that it has found no evidence that any customer data was examined or used maliciously and that the issue has been fully remediated.The letter does not say how the access happened, how long it lasted or how many people are affected. California requires a business to file a sample notice with the Attorney General when it sends breach notices to more than 500 California residents, so the filing indicates at least that many Californians received letters.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Which Citizens Bank Is This?
The California filing gives only the name Citizens Bank, and the letter is signed "Your Citizens Team." The filing does not include a legal entity name, a headquarters or a count of people notified, and several unrelated U.S. banks operate under the Citizens name. OCA has not been able to confirm which bank submitted it, or whether the September incident is connected to any earlier one. Anyone who received a letter can tell from the letter itself which bank they bank with.What Does the Letter Offer?
The notice offers a complimentary two-year membership in Equifax Credit Watch Gold, enrolled with an activation code printed on each letter. According to the letter, the service includes monitoring of the Equifax credit report with alerts, daily access to that report, WebScan alerts when personal information is found on suspected fraud trading sites, automatic fraud alerts, an Equifax credit report lock, identity restoration help and up to $1 million of identity theft insurance. Enrollment requires being over 18 with a credit file, and each letter states its own enrollment deadline.The letter also describes free steps available to anyone, including reviewing credit reports through AnnualCreditReport.com, placing a one-year fraud alert, and placing a security freeze at the nationwide consumer reporting agencies.
Citizens Financial Group's Earlier 2026 Incident and Lawsuits
Separately, Citizens Financial Group, the Providence, Rhode Island parent of Citizens Bank, N.A., dealt with a different incident earlier this year. In April 2026 the extortion group Everest listed Citizens as a victim and claimed to have taken 3.4 million records, American Banker reported. In an April 21 statement, Citizens attributed the incident to a third-party vendor and said most of the data was masked test data, that a "limited set of information for a small number of customers" was involved and, according to a spokesperson, that the data did not contain Social Security numbers. A threat-intelligence firm quoted by American Banker said Everest likely overstates the volume and sensitivity of what it claims to take.Four proposed class actions over that incident were filed in the U.S. District Court for the District of Rhode Island in April 2026, and a fifth, which the court treated as related, followed in May; all were assigned to Chief Judge John J. McConnell Jr. The four April cases have since been closed or voluntarily dismissed. The May case, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312, remains open; the court extended Citizens Bank's deadline to respond to the complaint to July 31, 2026. The claims in that case are unproven allegations.
OCA has not confirmed that the September notice came from the same bank, and nothing in the California filing links the two incidents.
What Happens Next?
As of October 20, 2026, OCA had not found a lawsuit over the September incident, and there is no settlement or claim form. Breach notices like this one are often followed by state attorney general filings in other states that list a legal entity name and the number of people notified; OCA will update this page if one confirms which bank filed it or how many people were affected.Questions
What information was exposed in the September 2026 Citizens Bank breach?
According to the sample notice filed with the California Attorney General, the information involved was name, Social Security number, date of birth, phone number and email address. The notice says the bank found no evidence that any customer data was examined or used maliciously.
Which Citizens bank sent the September 2026 breach notice?
The filing lists the organization only as Citizens Bank, and the letter is signed Your Citizens Team. Several unrelated U.S. banks use the Citizens name, and the filing does not give a legal entity name or headquarters, so OCA has not confirmed which bank filed it. The letter itself identifies the sender for anyone who received one.
Is there a class action or settlement over the Citizens Bank breach notice?
OCA found no lawsuit filed over the September 2026 incident as of October 20, 2026, and there is no settlement or claim form. A separate case over an April 2026 vendor incident, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312, is pending in federal court in Rhode Island.
What does the Citizens Bank breach notice offer?
The notice offers a complimentary two-year membership in Equifax Credit Watch Gold, which includes credit monitoring, dark web scanning, automatic fraud alerts, an Equifax credit report lock, identity restoration help and up to $1 million in identity theft insurance. Enrollment uses the activation code and deadline printed on each letter.
Sources and Verification
• California Attorney General, Submitted Breach Notification Sample: Citizens Bank (date of breach September 10, 2026; posted October 19, 2026), with the sample notice letter• American Banker, Citizens, Frost blame vendor after data breach claim (April 22, 2026) and Customers sue Citizens, Frost over third-party data breach (April 29, 2026)
• Court docket, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312 (D.R.I.), and related dockets 1:26-cv-00232, -00233, -00241 and -00246
