Citizens Bank Hit With New Data Breach Class Action Lawsuit After Second Security Incident in 2026, Social Security Numbers and Birth Dates Exposed

Citizens Bank, N.A. is facing a new proposed class action over a September 2026 security incident in which an unauthorized third party could access customer information. Shannon Rung filed Rung v. Citizens Bank, N.A., Case No. 1:26-cv-00781, on October 21, 2026, in the U.S. District Court for the District of Rhode Island.

Citizens’ breach notice says it identified the issue on September 10, 2026, and that the information involved includes names, Social Security numbers, dates of birth, telephone numbers and email addresses. The bank says it found no evidence that customer information was examined or used maliciously and that the issue has been fully remediated.

This is the bank’s second reported data security incident of 2026. The first, disclosed in April, involved data extracted from a third-party vendor and led to earlier lawsuits. The two events are separate, and the public records reviewed do not establish that they share a cause.

There is no settlement, claim form or compensation fund for the Rung lawsuit. It is a putative class action. No class has been certified, and no court has found Citizens Bank liable.

Quick Facts: Citizens Bank September 2026 Data Breach Lawsuit

Detail	Information
Plaintiff	Shannon Rung
Defendant	Citizens Bank, N.A.
Case	Rung v. Citizens Bank, N.A., No. 1:26-cv-00781
Court	U.S. District Court for the District of Rhode Island
Filed	October 21, 2026
Incident identified by Citizens	September 10, 2026
Breach notice posted	October 19, 2026 (California Attorney General)
Information involved	Names, Social Security numbers, dates of birth, phone numbers, email addresses
Affected population	14,371 Texas residents per Texas Attorney General filing; national total not confirmed
Bank’s position	No evidence information was examined or used maliciously; issue remediated
Free protection offered	Two years of Equifax Credit Watch Gold
Customer line in notice	1-866-950-8157
Plaintiff’s counsel	Peter N. Wasylyk (Law Offices of Peter N. Wasylyk) and Tyler A. Litke (Levi & Korsinsky LLP)
Proposed class	Nationwide consumers whose information was affected, as reported
Class certified	No
Settlement / claim form	None
Latest verified court activity	Complaint filed and summons issued October 21, 2026

Sources: Federal docket, California Attorney General breach filing and Citizens notification letter.

What Happened in the September 2026 Citizens Bank Data Breach?

According to the notification letter filed with the California Attorney General, Citizens identified an issue on September 10, 2026 that allowed some customer information to be accessed by an unauthorized third party. The letter says the bank found no evidence of examination or malicious use.

The notice does not say how the access happened. It does not identify the system involved, the third party, how long access was possible, whether data was copied, or whether the incident relates to the April event. Unauthorized access is not the same as confirmed misuse, but it is also not proof that nothing was taken.

What personal information did Citizens Bank say was involved?

Information	Why it matters
Name	Helps identify and impersonate a person
Social Security number	Can be used for identity theft and fraudulent credit applications
Date of birth	Can help pass identity-verification checks
Telephone number	Can be used for targeted scams
Email address	Can be used for phishing and account-recovery attacks

A name, Social Security number and birth date together are the core data used to impersonate someone. That describes the risk of exposure, not evidence that any fraud occurred here.

How many people were affected by the Citizens Bank September breach?

The California filing does not give a total. A Texas Attorney General record published October 20, 2026 lists 14,371 affected Texas residents. That is a Texas figure, not a national total, and a nationwide count has not been confirmed. Texas requires organizations to report breaches affecting at least 250 residents. See the Texas Attorney General’s data breach reporting page.

What Is Citizens Bank Offering Customers After the September Breach?

The notice offers a complimentary two-year membership in Equifax Credit Watch Gold. Listed features include credit monitoring with email alerts, daily access to an Equifax credit report, dark-web scanning, automatic fraud alerts, an Equifax credit report lock, identity restoration help and up to $1,000,000 in identity theft insurance for qualifying out-of-pocket costs. Users generally must be over 18 and have a credit file. The activation code and deadline are printed on each person’s letter.

The notice does not say that accepting the service waives legal rights, but read the Equifax terms before enrolling. This offer is not compensation from the lawsuit.

Read the Citizens breach notification letter.

What Happened in the First Citizens Bank Data Breach in April 2026?

On April 21, 2026, Citizens Financial Group said it was managing an incident involving data extracted from a third-party vendor. The bank said most of the material was masked test data, with a limited amount of information for a small number of actual customers, generally what appears on a check: names, mailing addresses and account numbers. It said it had no evidence of unauthorized access to its own network. In the April complaints, plaintiffs alleged the ransomware group Everest publicly claimed responsibility on April 20, 2026. That is an allegation in the pleadings, not a finding, and nothing in the September notice ties that group to the later incident.

Read Citizens’ April 21, 2026 statement.

Detail	April 2026 incident	September 2026 incident
Public disclosure	April 21, 2026	Notice posted October 19, 2026
Reported mechanism	Data extracted from a third-party vendor	Unauthorized third-party access; method not disclosed
Information	Names, addresses, account numbers; mostly masked test data	Names, SSNs, dates of birth, phone numbers, emails
Bank’s network	Citizens said no evidence of unauthorized access	Notice does not say
Misuse	No evidence of fraud, per Citizens	No evidence of examination or malicious use, per Citizens
Litigation	Earlier putative class actions	Rung v. Citizens Bank, N.A., No. 1:26-cv-00781

Did the April 2026 Citizens Bank breach lead to lawsuits?

Yes, and they are separate from Rung’s case.

• Hansford v. Citizens Bank, N.A., No. 1:26-cv-00232. Filed April 22, 2026. The docket shows a voluntary dismissal entered April 30, 2026. Docket.
• Russell Hauser v. Citizens Financial Group, Inc., No. 1:26-cv-00233. Filed April 22, 2026. The docket shows a voluntary dismissal with an order entered May 19, 2026. Docket.
• Smith v. Citizens Bank, N.A., No. 1:26-cv-00312. Filed May 15, 2026. The accessible docket shows Citizens received an extension to July 31, 2026 to respond. Its current status should not be assumed. Docket.

Readers who want the April background can also read our coverage: Citizens Bank Data Breach Class Action Lawsuit 2026, What Happened, Who Is Affected, and What to Do Now and Citizens Bank Data Breach Class Action Lawsuit, Were You a Customer When the Everest Hack Hit?.

What Does Rung v. Citizens Bank, N.A. Allege?

Shannon Rung filed the complaint October 21, 2026, and the court issued a summons to Citizens the same day. Reporting on the complaint says Rung alleges Citizens failed to use reasonable care to protect personal information, and that she suffered loss of privacy, time and expense spent monitoring accounts and credit reports, emotional distress and ongoing costs of mitigating identity theft risk. She reportedly seeks declaratory relief, damages for the proposed class and a jury trial.

Reported causes of action:

Claim	What it generally concerns
Negligence	Whether the bank failed to use reasonable care protecting customer information
Negligence per se	Whether violating a statute or regulation establishes breach of a legal duty
Unjust enrichment	Whether the bank kept a benefit it should not equitably retain
Breach of implied contract	Whether customers and the bank had an implied agreement to protect information
Breach of confidence	Whether information entrusted to the bank was improperly exposed

The public docket mirror reviewed did not include the complaint’s full text, so these claims and the class definition come from secondary summaries. Obtain the complaint through PACER to confirm them. These are allegations, not findings.

No settlement amount exists. Any figure such as a “$5 million fund” would be inaccurate for this case.

Who is the judge in Rung v. Citizens Bank?

The case was conditionally assigned to Chief Judge John J. McConnell Jr. and Magistrate Judge Rebecca L. Aitchison because the filing flagged a potentially related federal case, No. 1:26-cv-00779. That assignment was conditional on a determination of whether the cases are actually related.

Which Laws Apply to the Citizens Bank Data Breach Lawsuit?

• Gramm-Leach-Bliley Act, 15 U.S.C. § 6801(b). Directs regulators to set administrative, technical and physical safeguards for financial institutions to protect the security and confidentiality of customer information. GLBA does not automatically give consumers a private right to sue over a breach, so check what the complaint actually pleads. 15 U.S.C. § 6801.
• FTC Safeguards Rule, 16 C.F.R. Part 314. Sets information-security program requirements, including risk assessments, access controls and service-provider oversight, for financial institutions under FTC jurisdiction. A national bank like Citizens Bank, N.A. has a different primary federal regulator, so do not assume every provision applies directly. 16 C.F.R. Part 314.
• State negligence law. Requires a duty, breach, causation and legally recognized damages. A data incident alone does not establish negligence.
• Implied contract, unjust enrichment and breach of confidence. Each has its own elements under state law. None has been established against Citizens.
• State breach notification laws. California Civil Code § 1798.82 and Texas Business and Commerce Code § 521.053 govern notices to affected residents. Notification duties are separate from the negligence and contract theories in a lawsuit.

Can You Join the Citizens Bank Class Action Lawsuit?

There is no process to join. Rung seeks to represent a nationwide class, but certification requires a separate court decision under Rule 23 of the Federal Rules of Civil Procedure, which looks at numerosity, commonality, typicality, adequacy of representation, predominance and superiority. Until then, there is no court-approved class with a right to payment.

As of October 30, 2026, no settlement, administrator, claim website, payment amount or claim deadline exists. Be cautious of sites promising a guaranteed Citizens payout or charging a fee to “register.”

What Should Citizens Bank Customers Do After the September 2026 Breach?

1. Keep your notification letter. It lists the information involved and your activation code.
2. Activate the Equifax service before the deadline on your letter.
3. Check credit reports and statements for new accounts, hard inquiries and unfamiliar transactions.
4. Consider a security freeze with Equifax, Experian and TransUnion. It is free under federal law, and you must contact each bureau separately. See the CFPB’s credit freeze guidance.
5. If you got no letter, do not assume you were affected. Call Citizens using the number on its official website or your statement, not a number from an unsolicited message.

What Happens Next in Rung v. Citizens Bank, N.A.?

The docket reviewed shows the complaint, case-opening notice and summons, with no later merits ruling. Possible next stages include service and Citizens’ response, motions challenging the claims, discovery if the case proceeds, a class certification request and settlement talks. These are potential stages, not scheduled dates.

Citizens Bank Data Breach Timeline

Date	Event
April 20, 2026	Everest allegedly claims responsibility for the April vendor incident, per the April complaints
April 21, 2026	Citizens issues statement on third-party vendor incident
April 22, 2026	Hansford and Russell Hauser lawsuits filed
April 30, 2026	Hansford voluntarily dismissed
May 15, 2026	Smith lawsuit filed
May 19, 2026	Russell Hauser voluntarily dismissed
September 10, 2026	Citizens identifies the unauthorized access issue
October 19, 2026	California Attorney General posts Citizens notice
October 20, 2026	Texas Attorney General record lists 14,371 affected Texans
October 21, 2026	Rung v. Citizens Bank, N.A. filed; summons issued
October 30, 2026	No settlement or certification order identified

Other Data Breach Coverage on AllAboutLawyer

For another financial-services breach and the difference between an active lawsuit and an approved settlement, see Prosper Data Breach Lawsuit 2026, No Settlement Yet—17.6M Affected. Each case involves a different incident and class definition, so eligibility in one does not carry over to another.

Frequently Asked Questions About the Citizens Bank September 2026 Data Breach Lawsuit

Is there a class action against Citizens Bank over the September 2026 breach?

Yes. Rung v. Citizens Bank, N.A., No. 1:26-cv-00781, was filed October 21, 2026 in the District of Rhode Island. It is a putative class action with no certified class.

What information was exposed in the Citizens Bank breach?

Names, Social Security numbers, dates of birth, telephone numbers and email addresses, according to the bank’s notice.

When did the Citizens Bank breach happen?

Citizens identified the issue on September 10, 2026. The California Attorney General posted the notice October 19.

How many people were affected?

The Texas Attorney General record lists 14,371 Texas residents. No national total has been confirmed.

Did Citizens confirm the data was stolen or misused?

The bank confirmed an unauthorized third party could access information. Its notice says it found no evidence of examination or malicious use.

Is this the same breach as April 2026?

No. April involved data extracted from a third-party vendor. September was identified separately and involved different reported data. No public source reviewed ties them together.

How much money can customers get?

None has been ordered. There is no settlement fund or claim process.

Is there a Citizens Bank breach claim form?

No, not as of October 30, 2026.

Has Citizens admitted wrongdoing?

No admission of liability has been identified. The allegations are unproven and disputed.

Can former customers be in the class?

Possibly, if they meet the class definition a court eventually approves. Having had an account does not show your information was involved.

Who represents Shannon Rung?

Peter N. Wasylyk of the Law Offices of Peter N. Wasylyk and Tyler A. Litke of Levi & Korsinsky LLP.

Primary Sources and Verification Notes

1. Federal docket: Rung v. Citizens Bank, N.A., No. 1:26-cv-00781. Plaintiff, defendant, court, filing date, complaint and summons.
2. California Attorney General: Citizens breach filing. Organization name and September 10, 2026 incident date.
3. Citizens notification letter: Notification of Data Breach from Citizens. Information involved, bank’s position, Equifax offer and contact number.
4. Citizens Financial Group: April 21, 2026 statement.
5. Texas Attorney General: Data breach reporting.
6. Federal rules: 15 U.S.C. § 6801 and 16 C.F.R. Part 314.
7. CFPB: Credit freeze guidance.

Verification note: The docket confirms the Rung complaint and summons. The complaint’s full text was not available, so its causes of action and class language come from secondary reports. The Texas count is a Texas-only figure. No class certification, settlement, damages award or claim process has been confirmed as of October 30, 2026.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the federal court docket in Rung v. Citizens Bank, N.A., the California Attorney General’s breach filing and Citizens’ notification letter, and Citizens Financial Group’s April 21, 2026 statement, as of October 30, 2026. Last Updated: October 30, 2026.

AllAboutLawyer.com is an independent consumer information site, not a law firm. This article is not legal or financial advice. The allegations against Citizens Bank remain unproven.