Citizens Bank Hit With Two Federal Lawsuits After Everest Ransomware Attack
Following our initial report on the Everest ransomware group's claims, Citizens Financial Group now faces a dual-front battle as federal litigation arrives in Rhode Island.
PROVIDENCE, RI — The legal fallout from the Everest ransomware group’s alleged breach of Citizens Bank has accelerated with the filing of two separate federal class action lawsuits in the US District Court for the District of Rhode Island. The litigation, filed on April 23, 2026, follows a "data incident via a third-party vendor" that the bank confirmed earlier this week.
The plaintiffs, Betty Lackey and Pamela Caffrey, represent a potentially massive class of customers whose names, Social Security numbers (SSNs), dates of birth, and financial account details were allegedly exposed. While Everest claims to have exfiltrated 3.4 million records, Citizens maintains that the vast majority of the data involved was "masked test data" rather than live production records.
Breach Audit: Litigation Timeline
The speed of these filings — arriving just days after the initial threat actor claim — underscores a new reality in risk management: the litigation window has closed to near-zero.
Allegations of Negligence
The 34-page and 40-page complaints allege that Citizens failed to implement industry-standard security measures, specifically citing a lack of multi-factor authentication (MFA) and IP-based restrictions on the vendor’s database. Counsel for the plaintiffs argue that the bank breached its fiduciary duty by allowing sensitive PII to remain vulnerable in a non-production environment.
Citizens has pushed back, stating that "operations continue as normal" and that there is no evidence of a compromise within their core internal network. However, the legal focus remains on vendor vulnerability management, a pattern we have seen in other recent systemic fragility incidents.
The CyberSignal Analysis
Signal 01 — The "Masked Data" Defense
Citizens' primary defense rests on the claim that the stolen data was "masked." In data governance terms, if the masking was insufficient or reversible, the bank still faces full liability. The lawsuits will likely force a discovery process to determine if the "test data" was actually pseudonymized production data — a frequent oversight in financial DevOps cycles.
Signal 02 — The Escalation of Vendor Liability
This case highlights the growing trend of "vendor-leaping," where threat actors bypass a bank’s hardened perimeter by targeting softer third-party partners. For CISOs, this means cyber essentials must be enforced not just on partners, but specifically on the testing and staging environments those partners use.
