Yes, a class action settlement could follow the Citizens Bank data breach. Plaintiff Shannon Rung filed a federal case over the September incident on October 21, 2026.
A class action is one lawsuit brought for many people with the same harm. Citizens says it fixed an issue found September 10, 2026 that let an unauthorized party reach customer data. No settlement has been announced.
Official resources:
- Read the official notice from Govinfo — Use this primary source to verify the official announcement.
- Explore the official data from Abingtonlaw — Use this primary source to review the underlying data.
Table of Contents
- What customer data was exposed?
- How widespread is the breach?
- Has a class action started?
- What should notified customers do now?
What customer data was exposed?
TEISS reported the exposed information included names, Social Security numbers, dates of birth, phone numbers and email addresses in the TEISS breach report. Citizens says the issue has been remediated.
Cybernews, describing the customer notice, reports Citizens said it found no evidence the accessed data was examined or misused. That statement matters because class recovery often turns on proven harm or risk. Social Security numbers and birth dates carry higher identity-theft risk than phone numbers alone.
How widespread is the breach?
Abington Cole + Ellery, citing state filings, reports 14,371 Texas residents affected in Texas filing BR-0005433 published October 20, 2026, with underlying data pointing to 1,260,000 people nationwide in the Abington data-breach report. The California Attorney General listing shows a sample Citizens Bank notice dated October 19, 2026. This is Citizens' second 2026 incident.
TEISS reports the Everest group claimed about 3.4 million records in April through a third-party vendor, while Citizens said the material was mostly masked test data for a small customer subset. A September 3, 2026 federal order in the related Sefas vendor case, from the U.S. District Court for Massachusetts, states Everest entered Sefas servers in December 2025 and went undiscovered until April 16, 2026, reaching millions of Frost Bank and Citizens customer records.
Has a class action started?
Justia Dockets lists Rung v. Citizens Bank, N.A., No. 1:2026cv00781, filed October 21, 2026 in the U.S. District Court for Rhode Island by plaintiff Shannon Rung over the September incident in the Justia docket search.
The filing begins litigation but does not create a claim form. A filing does not promise payment or certification. Early data-breach cases often test standing and harm, and Citizens' no-misuse statement will likely feature in that fight. Any settlement would need court approval and clear eligibility rules.
What should notified customers do now?
Citizens is offering two years of Equifax Credit Watch Gold with monitoring, identity restoration and up to $1 million in insurance. Enrollment needs the activation code from the letter and must be completed before its deadline.
TEISS reports victims should also monitor accounts and consider freezes. Those steps do not join a lawsuit or preserve a claim.
- Use the letter's activation code to enroll in the Equifax offer before the stated deadline
- Watch bank statements, credit reports and account alerts for unfamiliar activity
- Consider a credit freeze or fraud alert if your Social Security number was exposed