---
title: "Citizens Bank September 2026 personal-data access incident"
description: "Citizens Bank reported an issue allowing unauthorized access to personal information, detected September 10, 2026."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-20"
canonical_url: "https://www.ally.security/incidents/citizens-bank-personal-data-access-2026"
markdown_url: "https://www.ally.security/incidents/citizens-bank-personal-data-access-2026.md"
stix_url: "https://www.ally.security/incidents/citizens-bank-personal-data-access-2026/stix.json"
---

# Citizens Bank September 2026 personal-data access incident

The bank remediated an access issue and notified affected customers.

Last modified Oct 20, 2026 · 2 sources

## Summary

- **Environment:** Citizens Bank personal-data systems
- **Operational impact:** Unauthorized access possible; no service outage established
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Citizens Bank](https://www.citizensbank.com/) identified an issue on September 10, 2026 that allowed a third party to access personal data, according to its [notification](https://oag.ca.gov/system/files/Citizens%20Bank%20-%20Breach_Notice.pdf). September 10 is the detection date; the notice does not establish when access began. [1](#source-1)

## Impact

The listed information includes names, Social Security numbers, birth dates, phone numbers and email addresses. Citizens said it had no evidence the data was examined or used maliciously and no knowledge of related fraud or identity theft. These statements do not erase the access issue. [1](#source-1)

## Timeline

### September 10, 2026 — Access issue identified

The bank detected the issue. [1](#source-1)

### October 19, 2026 — California report recorded

The [state registry](https://oag.ca.gov/privacy/databreach/list) recorded the notification; the sample letter itself is undated. [2](#source-2)

### October 20, 2026 — Briefing updated

This briefing was last reviewed and updated on October 20, 2026.

## Threat Group & Attack Vector

The notice does not establish the technical access path, a threat actor or confirmed data theft.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Citizens said the issue was fully remediated and offered two years of credit monitoring through [Equifax](https://www.equifax.com/). No precise remediation date or affected-person count is established. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/citizens-bank-personal-data-access-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Citizens Bank September 2026 data-access notice

official · Citizens Bank

<https://oag.ca.gov/system/files/Citizens%20Bank%20-%20Breach_Notice.pdf>

<a id="source-2"></a>

### Data Security Breach List — 2026 records

regulatory · California Department of Justice, Office of the Attorney General

<https://oag.ca.gov/privacy/databreach/list>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Dates of birth
2. **Occurred At · 100% confidence · current**  
   California report recorded: 2026-10-19
3. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Social Security numbers
4. **Discovered At · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: 2026-09-10
5. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: California report recorded
6. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Personal information described in the notification
7. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Names
8. **Occurred At · 100% confidence · current**  
   Access issue identified: 2026-09-10
9. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Citizens said it had no evidence customer data was examined or used maliciously and no knowledge of related identity theft or fraud.
10. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Access issue identified
11. **Affected Organization · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Citizens Bank
12. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Citizens identified an issue that allowed an unauthorized third party to access some personal data.
13. **Exposed Data Category · 100% confidence · current**  
   Personal information described in the notification: Contact information
14. **Resulted In · 100% confidence · current**  
   Citizens Bank September 2026 personal-data access incident: Citizens said it fully remediated the issue and offered two years of credit monitoring through Equifax.

</details>