Citizens Bank Data Breach: What Information Was Exposed?

Citizens Bank, one of the largest banks in the United States, has notified customers of a data breach that may have exposed sensitive personal information, including Social Security numbers and dates of birth. The bank says it identified the incident on September 10, 2026.

What Happened in the Citizens Bank Data Breach?

According to the bank’s notice, Citizens Bank identified the security incident on September 10, 2026. It found that an unauthorized third party had gained access to a system containing customers’ personal information. The bank has since told affected customers, and says it has fixed the issue.

Citizens Bank says it has no evidence that the information has been misused. How the unauthorized party got in, how long they had access, and how many people were affected have not been publicly confirmed.

This is the second security incident Citizens Bank has reported in 2026. In April, the bank disclosed a separate incident involving data taken from a third-party vendor, which affected information that appears on written checks. The September incident is a different event, so some customers may receive more than one notice.

What Information Was Exposed?

According to the available reporting, the information potentially affected may have included:

• Social Security numbers
• Dates of birth
• Other personal information described in each customer’s notice

The information involved may vary by individual, and not everyone had every data element exposed. Social Security numbers and dates of birth are among the most sensitive details a person has. Together they can be used to open new accounts, take out loans, file fraudulent tax returns, or take over existing accounts, and they can’t easily be changed.

What Should You Do After the Citizens Bank Data Breach?

If you received a notice from Citizens Bank, or believe your information may have been affected, consider taking these steps:

• Review your notice. Read it carefully, since it should describe what information of yours was involved, and keep a copy for your records.
• Enroll in the free credit monitoring. Citizens Bank is offering affected customers two years of credit monitoring and identity protection. Use the instructions in your notice to sign up.
• Review your accounts. Check your bank and card statements for transactions you don’t recognize, and report anything suspicious right away.
• Check your credit reports. You’re entitled to a free report each year from Equifax, Experian, and TransUnion.
• Consider a fraud alert or credit freeze. Both are free, and a freeze is especially worth considering when Social Security numbers may be exposed.
• Update your passwords. Change your online banking password, and the password on any other account where you reused it. Turn on multi-factor authentication where available.
• Be cautious of unsolicited contact. Be wary of unexpected emails, texts, or calls that mention Citizens Bank or this breach and ask for personal or account information. If you’re unsure, contact the bank through a number you know is real, such as the one on your card or statement.

Can You Take Legal Action After the Citizens Bank Data Breach?

If your personal information may have been exposed in the Citizens Bank data breach, you may have questions about your rights and potential legal options. Whether you can bring a claim depends on the circumstances of the incident and the harm you suffered.

Morgan & Morgan is investigating data breach incidents to help determine whether affected individuals may have legal options. See if you qualify for a case.