Summary
- Environment: Citizens Bank personal-data systems
- Operational impact: Unauthorized access possible; no service outage established
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 20, 2026; updated as evidence emerges.
What happened
Citizens Bank identified an issue on September 10, 2026 that allowed a third party to access personal data, according to its notification. September 10 is the detection date; the notice does not establish when access began. [1]
Impact
The listed information includes names, Social Security numbers, birth dates, phone numbers and email addresses. Citizens said it had no evidence the data was examined or used maliciously and no knowledge of related fraud or identity theft. These statements do not erase the access issue. [1]
Timeline
Access issue identified
The bank detected the issue.
[1]California report recorded
The state registry recorded the notification; the sample letter itself is undated.
[2]Briefing updated
This briefing was last reviewed and updated on October 20, 2026.
Threat Group & Attack Vector
The notice does not establish the technical access path, a threat actor or confirmed data theft.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.