F500 Banks & Financial · Commercial Banks · Data breach
Citizens Financial
Headline
The April 2026 incident was attributed to a Russian ransomware group.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The April 2026 incident was attributed to a Russian ransomware group. Beyond the breach itself, the note worth recording for every regional bank row in this tracker is that a bank holds the single most complete behavioural record that exists about a person - every transaction, every counterparty, every location, continuously - and the Gramm-Leach-Bliley framework governing it permits substantially more affiliate sharing than most customers assume, with an opt-out that is mailed once and rarely exercised.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual account agreements, separate from the class actions noted above (status not re-verified Oct 2026).
Data sharing
CONFIRMED VERY RECENT BREACH (April 2026): the Russian ransomware group EVEREST publicly claimed responsibility for attacking an UNNAMED third-party vendor holding Citizens Bank customer data on or about April 20, 2026 — Everest claimed to have acquired 3.4 MILLION RECORDS and posted data on the dark web (reportedly names, home addresses and account numbers; a complaint alleges, 'upon information and good faith belief,' that Social Security numbers were also exposed, while Citizens says the data was limited to information typically on written checks and was mostly masked test data). Citizens characterized the impact as affecting 'a small number of customers,' but at least two federal class actions were filed against Citizens within days in U.S. District Court in Providence, R.I. (Boston Globe, Apr. 24, 2026; GoLocalProv) (Frost Bank, hit in the same Everest campaign, faced separate scrutiny), alleging the real scope may be far larger than Citizens' own characterization — a genuine, unresolved dispute over the breach's true scale. The complaints assert negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty and recklessness, each seeking more than $5 million; Citizens says the claims are 'generally inaccurate.'
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy citizensbank.com/privacy.aspx | Not fetched yet | NO (HTML only) |
| Terms of service citizensbank.com/terms-of-use.aspx | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.