Reports surfaced in April 2026 regarding an alleged data breach impacting customers of Citizens Bank and Frost Bank. The incident stemmed from a compromise of a third-party vendor responsible for tax document fulfillment, orchestrated by the Everest ransomware group. The group claimed to have accessed customer data on April 20, 2026.
For Citizens Bank, the compromised data included full names, home addresses, account numbers, and internal document flags. For Frost Bank, the breach potentially exposed SSNs, tax IDs, mortgage interest rates, investment profits, income data, taxable amounts, and home addresses. Citizens Bank acknowledged the breach on April 21, 2026, stating that much of the compromised data was "masked test data," with limited real customer information exposed. Frost Bank also acknowledged the possibility of customer data inclusion but found no evidence of unauthorized access to its network. The total number of affected individuals is estimated to be around 3.6 million, with 3.4 million from Citizens Bank and 250,000 from Frost Bank.
A deadline was set for April 27, 2026, for payment before the data was released publicly. Details regarding specific state attorney general filings or formal breach letters have not been made available.