Customers who receive a Citizens Bank breach letter about an incident identified on September 10, 2026 are being told that their names, Social Security numbers and dates of birth were accessed by an unauthorized third party. A proposed class action, Rung v. Citizens Bank, N.A., was filed in Rhode Island federal court on October 21, 2026; there is no settlement and nothing to claim.
Lawsuit Filed · Allegations Only · Nothing to Claim
This article reports a data breach notice, a newly filed lawsuit and a pending lawsuit over an earlier incident. Claims in those lawsuits are unproven allegations; no bank has been found liable, no class has been certified, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What Is This About?
On October 19, 2026, a sample data breach notice was posted to the California Attorney General's data breach list under the organization name Citizens Bank. The letter, headed "Notification of Data Breach from Citizens," says that on September 10, 2026, Citizens identified an issue that allowed some data to be accessed by an unauthorized third party. It says the information involved was name, Social Security number, date of birth, phone number and email address. The bank writes that it has found no evidence that any customer data was examined or used maliciously and that the issue has been fully remediated.The letter does not say how the access happened, how long it lasted or how many people are affected. California requires a business to file a sample notice with the Attorney General when it sends breach notices to more than 500 California residents, so the filing indicates at least that many Californians received letters.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Which Citizens Bank Is This?
The California filing gives only the name Citizens Bank, and the letter is signed "Your Citizens Team." The filing does not include a legal entity name, a headquarters or a count of people notified, and several unrelated U.S. banks operate under the Citizens name. OCA has not been able to confirm which bank submitted it, or whether the September incident is connected to any earlier one. The October 21 lawsuit names Citizens Bank, N.A., the Rhode Island–based subsidiary of Citizens Financial Group, as the defendant. Until the complaint is public, OCA cannot confirm how it ties that bank to the September notice. Anyone who received a letter can tell from the letter itself which bank they bank with.What Does the Letter Offer?
The notice offers a complimentary two-year membership in Equifax Credit Watch Gold, enrolled with an activation code printed on each letter. According to the letter, the service includes monitoring of the Equifax credit report with alerts, daily access to that report, WebScan alerts when personal information is found on suspected fraud trading sites, automatic fraud alerts, an Equifax credit report lock, identity restoration help and up to $1 million of identity theft insurance. Enrollment requires being over 18 with a credit file, and each letter states its own enrollment deadline.The letter also describes free steps available to anyone, including reviewing credit reports through AnnualCreditReport.com, placing a one-year fraud alert, and placing a security freeze at the nationwide consumer reporting agencies.
Citizens Financial Group's Earlier 2026 Incident and Lawsuits
Separately, Citizens Financial Group, the Providence, Rhode Island parent of Citizens Bank, N.A., dealt with a different incident earlier this year. In April 2026 the extortion group Everest listed Citizens as a victim and claimed to have taken 3.4 million records, American Banker reported. In an April 21 statement, Citizens attributed the incident to a third-party vendor and said most of the data was masked test data, that a "limited set of information for a small number of customers" was involved and, according to a spokesperson, that the data did not contain Social Security numbers. A threat-intelligence firm quoted by American Banker said Everest likely overstates the volume and sensitivity of what it claims to take.Four proposed class actions over that incident were filed in the U.S. District Court for the District of Rhode Island in April 2026, and a fifth, which the court treated as related, followed in May; all were assigned to Chief Judge John J. McConnell Jr. The four April cases have since been closed or voluntarily dismissed. The May case, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312, remains open; the court extended Citizens Bank's deadline to respond to the complaint to July 31, 2026. The claims in that case are unproven allegations.
OCA has not confirmed that the September notice came from the same bank, and nothing in the California filing links the two incidents.
Lawsuit Filed Over the September Incident
On October 21, 2026, a proposed class action titled Rung v. Citizens Bank, N.A., No. 1:26-cv-00781, was filed in the U.S. District Court for the District of Rhode Island and assigned to Chief Judge John J. McConnell Jr., who also presides over the earlier Citizens cases. Citizens Bank, N.A. is the Providence-based subsidiary of Citizens Financial Group. The complaint had not been posted to the public docket when this page was updated, so OCA has not reviewed its allegations, its proposed class or whether it is limited to the September incident. Any claims in it are unproven allegations.A data security breach listing on the Texas Attorney General’s site reports 14,371 Texans affected. A national total has not been made public. There is no settlement or claim form. OCA will update this page when the complaint becomes available or when other state filings report how many people were notified.
Questions
What information was exposed in the September 2026 Citizens Bank breach?
According to the sample notice filed with the California Attorney General, the information involved was name, Social Security number, date of birth, phone number and email address. The notice says the bank found no evidence that any customer data was examined or used maliciously.
Which Citizens bank sent the September 2026 breach notice?
The filing lists the organization only as Citizens Bank, and the letter is signed Your Citizens Team. Several unrelated U.S. banks use the Citizens name, and the filing does not give a legal entity name or headquarters, so OCA has not confirmed which bank filed it. The letter itself identifies the sender for anyone who received one.
Is there a class action or settlement over the Citizens Bank breach notice?
A proposed class action, Rung v. Citizens Bank, N.A., No. 1:26-cv-00781, was filed in federal court in Rhode Island on October 21, 2026, two days after the California notice was posted. The complaint was not yet publicly available, so OCA has not reviewed its allegations. There is no settlement or claim form. A separate case over an April 2026 vendor incident, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312, is also pending in Rhode Island.
What does the Citizens Bank breach notice offer?
The notice offers a complimentary two-year membership in Equifax Credit Watch Gold, which includes credit monitoring, dark web scanning, automatic fraud alerts, an Equifax credit report lock, identity restoration help and up to $1 million in identity theft insurance. Enrollment uses the activation code and deadline printed on each letter.
Sources and Verification
• California Attorney General, Submitted Breach Notification Sample: Citizens Bank (date of breach September 10, 2026; posted October 19, 2026), with the sample notice letter• American Banker, Citizens, Frost blame vendor after data breach claim (April 22, 2026) and Customers sue Citizens, Frost over third-party data breach (April 29, 2026)
• Court docket, Rung v. Citizens Bank, N.A., No. 1:26-cv-00781 (D.R.I.), filed October 21, 2026
• Texas Attorney General, Data Security Breach Reports (Citizens Bank listing, 14,371 Texans)
• Court docket, Smith v. Citizens Bank, N.A., No. 1:26-cv-00312 (D.R.I.), and related dockets 1:26-cv-00232, -00233, -00241 and -00246
