Yes. If a Citizens case is certified as a class action, described customers are usually included automatically unless they opt out. A class action is a lawsuit where one ruling can cover many people with the same claim, so most customers wait rather than file to join now.
Two proposed class actions were filed April 22, 2026 in U.S. District Court in Providence over exposed personal and financial information, according to Providence Business News in its lawsuit report. A separate September access involved Social Security numbers and other identifiers, according to teiss in its breach notice report.
Official resource:
- Register through Uscourts’s official page — Use this page to review requirements and register directly.
Table of Contents
- Which Citizens lawsuits exist?
- What is claimed about the April vendor incident?
- What happened in the September incident?
- Do customers need to join now?
Which Citizens lawsuits exist?
The April cases are Jillian Russell Hauser v. Citizens entities and Lorien Hansford v. Citizens Bank. Providence Business News reported both allege negligence tied to exposed personal and financial information.
Proposed means the court has not yet decided who is covered. National firms are also reviewing the later incident. Ahdoot & Wolfson says it is investigating potential class-action claims tied to the Sept. 10, 2026 access and asks notice recipients to submit information for review. Chimicles is conducting a similar investigation, according to the same investigation materials.
What is claimed about the April vendor incident?
Gblock reported the Everest gang listed Citizens Financial Group and Frost Bank on its dark-web leak site on April 20, 2026. The gang set an April 27 payment date and claimed about 3.4 million Citizens records plus 250,000 Frost records from one unnamed shared vendor, in Gblock's April 25 report.
Citizens gave a much narrower account to the Boston Globe, as relayed in that same Gblock reporting. It said most April vendor data was masked test data affecting only a few thousand customers. The stated exposure was limited to check-style name, address and account-number information.
What happened in the September incident?
Citizens identified unauthorized third-party access on Sept. 10, 2026. The exposed data included customer names, Social Security numbers, dates of birth, phone numbers and email addresses. A sample Sept.
19/Oct. 19 letter appeared in the California Attorney General's office listing. Teiss reported the sample does not state the total number affected or explain how access occurred. That limit matters because readers should rely on their own letter for personal dates and instructions.
Do customers need to join now?
In most Federal Rule 23 class actions, members do not file a form to join before certification. The Fourth Circuit explains the class presumptively includes described members unless they opt out, in the court's class-action opinion.
The practical path is to wait for certification and mailed settlement notice. September notice recipients have near-term steps tied to their letters: The monitoring offer includes monitoring, alerts, report access and lock, restoration help and up to $1 million identity-theft insurance. Use the code in the letter to activate before the stated deadline.
- Keep the breach letter and envelope with the activation code and deadline.
- Enroll in the offered free two-year Equifax Credit Watch Gold before the stated deadline.
- Watch bank statements, credit reports and alerts for unfamiliar accounts or charges.