Citizens Bank data breach lawsuit (Rung v. Citizens Bank, N.A.)

Citizens Bank is facing a proposed class action over a September 2026 data breach that exposed customers' names, Social Security numbers, dates of birth, phone numbers and email addresses. The bank's notice letter says it identified the problem on September 10, 2026, after "some data" was accessed by an unauthorized third party. Citizens told customers it found no evidence the data was examined or misused.

The case is Rung v. Citizens Bank, N.A., No. 1:26-cv-00781, filed October 21, 2026, in the U.S. District Court for the District of Rhode Island. It is the second wave of data breach litigation against Citizens this year, after a separate vendor incident in April. The new case is at the very start. There is no settlement, no claim form and no money available, and no court has ruled on the claims. Customers who received the notice can enroll in two years of free credit monitoring that Citizens is offering now.

The defendant is Citizens Bank, N.A., the banking subsidiary of Citizens Financial Group, Inc. Citizens is headquartered in Providence, Rhode Island, and offers consumer, private, wealth and commercial banking. It operates about 1,000 branches in 14 states and the District of Columbia and reported $234.5 billion in total assets at September 30, 2026, according to its third-quarter 2026 report.

The plaintiff is Shannon Rung, who seeks to represent a nationwide class. She is represented by Peter N. Wasylyk of the Law Offices of Peter N. Wasylyk and Tyler A. Litke of Levi & Korsinsky, LLP, according to Top Class Actions. The court docket lists Chief Judge John J. McConnell Jr. and Magistrate Judge Rebecca L. Aitchison.

The docket marks the case as related to Frampton-Strickler v. Citizens Financial Group, Inc., No. 1:26-cv-00779, filed October 20, 2026, also by Wasylyk. This page could not confirm what that complaint alleges.

• April 2026: in a separate incident, a hacker group claimed to have stolen Citizens data through a third-party vendor. Citizens said the claims were "generally inaccurate" and that most of the data was masked test data, according to the Boston Globe. Class action lawsuits followed.
• September 10, 2026: Citizens "identified an issue that allowed some data to be accessed by an unauthorized third-party," according to its notice letter.
• October 19, 2026: Citizens filed a sample notice with the California Attorney General, listing September 10 as the breach date.
• October 20 and 21, 2026: the Frampton-Strickler and Rung cases were filed in Rhode Island federal court.

Citizens has not publicly said how many people were affected or how the third party got access. The California filing does not include a count.

Rung says Citizens failed to take reasonable precautions to secure private information despite "numerous statutory, regulatory, contractual and common law duties" to do so, according to Top Class Actions. The complaint says she has lost time and money monitoring her accounts and credit reports, and claims loss of privacy and emotional distress. It asserts negligence, negligence per se, unjust enrichment, breach of implied contract and breach of confidence. It asks for a jury trial, declaratory relief and statutory damages.

Citizens' position comes from its notice letter, which says: "We have found no evidence that any customer data was examined or used maliciously, and the issue has been fully remediated." The bank says it is not aware of any fraud or identity theft involving the information and is offering credit monitoring "as a courtesy." Citizens has not filed a response in court.

Nothing has been decided. The complaint has been filed with one exhibit, and no class has been certified. The court has not ruled on whether Citizens was negligent or whether customers were harmed. It is not yet known whether the Rung and Frampton-Strickler cases will be combined, or how they relate to the earlier suits over the April vendor incident.

Rung proposes a nationwide class of people whose private information was affected by the breach announced in October 2026. The exact class definition in the complaint was not available for review. Based on the notice, you are most likely covered if:

• You received a "Notification of Data Breach from Citizens" letter about the September 10, 2026 incident.
• Your name, Social Security number, date of birth, phone number or email address was involved.

Customers affected only by the April 2026 vendor incident are part of different lawsuits. No class has been approved, and the definition could change.

• Enroll in the free monitoring. The notice offers a two-year membership in Equifax Credit Watch Gold, with credit monitoring, fraud alerts, credit report lock and up to $1,000,000 in identity theft insurance. Use the activation code in your letter at equifax.com/activate before the enrollment deadline printed on it.
• Review your Citizens statements and credit reports, and report anything suspicious to the bank.
• Call Citizens at 1-866-950-8157 with questions about the notice.
• Keep copies of the letter and records of any fraud, costs or time spent.

A Class Action Pulse inquiry is only an inquiry. It does not join the lawsuit or create a lawyer relationship.

There is no settlement and no cash available. The lawsuit seeks damages, statutory damages and other relief, but nothing has been awarded. The only benefit available now is the free Equifax monitoring Citizens offered in its notice, which is separate from the lawsuit.

• September 10, 2026: incident identified.
• October 19, 2026: notice filed with the California Attorney General.
• October 21, 2026: Rung lawsuit filed.
• Monitoring enrollment: deadline printed on each customer's letter.
• Claim deadline: none. There is no settlement.

You keep the right to hire your own lawyer. If a class is later certified or a settlement is reached, you would receive notice and a chance to opt out.

• Negligence per se: a claim that a defendant was negligent because it broke a law or regulation meant to protect people like the plaintiff.
• Breach of confidence: a claim that a business disclosed or failed to protect information it received in confidence.
• Declaratory relief: a court statement of the parties' rights, such as a finding that security was inadequate.
• Related case: a case the court flags as connected to another, often because it involves the same events.
• Credit monitoring: a service that alerts you to changes in your credit file.

Citizens will be served and is expected to respond. The court may combine related cases, and more suits may be filed. If a class is certified or a settlement is reached, class members would receive official notice. This page will be updated as the case develops.

Incident details come from Citizens' notice letter and its California Attorney General filing. Case numbers, judges and filing dates come from the court dockets. The complaint itself was not available, so its allegations and quotes come from Top Class Actions' summary. The number of affected customers is not public. The April 2026 incident is described from the Boston Globe's reporting and is a separate matter.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.