Citizens Bank data breach: what to do now

What happened

Citizens says that on September 10, 2026, it identified an issue that allowed some customer data to be accessed by an unauthorized third party. The bank says the issue has been fully fixed and that it found no evidence that customer data was examined or used maliciously. Its letter doesn't say when the access began, what system was involved, or how many customers were affected.

This is a separate incident from one Citizens disclosed in April 2026, when data was taken from one of its outside vendors. In that case, Citizens said most of the data was masked test data and that a limited set of information for a small number of customers was involved.

What information was exposed

• Name
• Social Security number
• Date of birth
• Phone number
• Email address

What to do now

1. Freeze your credit at Equifax, Experian, and TransUnion. A freeze is free, stops new accounts from being opened in your name, and you can lift it when you need to apply for credit.
2. Enroll in the free two-year Equifax credit monitoring Citizens is offering. Go to equifax.com/activate and enter the activation code from your letter, before the deadline your letter gives.
3. Check your free credit reports at AnnualCreditReport.com for accounts you didn't open.
4. Watch your Citizens and other bank statements, and tell your bank right away about anything you don't recognize.
5. Be ready for scams. Callers or texts may pretend to be Citizens and already know your name, birth date, and phone number. Never share passwords, PINs, or one-time codes. Hang up and call the number on your card or statement.

Ask Citizens Bank to delete your data

The fewer companies that keep your data, the less there is to steal next time. Banking information covered by the federal Gramm-Leach-Bliley Act (GLBA) is generally exempt from state deletion rights, and banks must keep account records for set periods. Other data, such as marketing and website data, may still be deletable.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, covered companies generally have to respond within the deadline your state sets, though financial information covered by the GLBA is generally exempt. See what your state's law requires.

Sources: California Attorney General breach notice, Cybernews, and Citizens statement on the April 2026 vendor incident. DataTrail isn't affiliated with Citizens Bank. This page is general information, not legal advice.