Citizens Bank Customers Targeted in Third-Party Data Breach

• The Everest ransomware gang posted both banks on their dark web site, employing 'double extortion' tactics by threatening to leak stolen data if ransom demands are not met
• PYMNTS Intelligence research shows third-party vendors are central to modern cyberattacks, with 38% of invoice fraud cases and 43% of phishing attacks originating from compromised vendors
• Both banks have engaged external cybersecurity experts and implemented enhanced monitoring, with no evidence of unauthorized access to their own networks

Summary: Citizens Bank Customers Targeted in Third-Party Data Breach

Two U.S. banks—Citizens Bank and Texas-based Frost Bank—are investigating data breaches stemming from a compromised third-party vendor. Citizens Bank confirmed on April 21, 2026, that most exposed data consisted of masked test information, with only a limited set affecting a small number of customers. Both institutions reported no evidence of unauthorized access to their internal networks and are maintaining normal operations with enhanced monitoring.

According to Cyber News, both banks appeared on the Everest ransomware gang's dark web site, with attackers issuing a six-day deadline before releasing stolen data. The incident highlights the growing threat of "double extortion" ransomware attacks, where cybercriminals encrypt files and threaten to leak stolen information unless payment is made.

Key Market Implications:

The breach underscores escalating third-party vendor risks in the financial sector. Both banks have engaged external cybersecurity experts to investigate the incident's scope and connection to recent cybercriminal claims.

Critical Data Points:

Research from PYMNTS Intelligence reveals that compromised vendors are central to contemporary cyberattacks:

• 38% of invoice fraud cases originate from compromised vendors
• 43% of phishing attacks stem from vendor breaches

The incident reflects ransomware's evolution into a "structured, global industry" operating with business-like efficiency. This has spawned a new profession—ransomware negotiators—who function as "corporate diplomats" managing cyber risk as a strategic business concern rather than purely a technical problem.

The breach emphasizes that cybersecurity is increasingly a board-level business risk requiring strategic management, particularly regarding vendor relationships and supply chain vulnerabilities in the financial services sector.