Citizens Bank listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United States
• Sector: Financial Services
• Announcement date: April 20, 2026

Everest ransomware group claims data breach at Citizens Bank

The Everest ransomware group has officially listed Citizens Bank on its dedicated leak site. According to the announcement, the threat actors claim to be in possession of sensitive data belonging to the financial institution. This development follows the group's established pattern of targeting high-value organizations to exert pressure through public exposure of stolen information.

The incident was announced on April 20, 2026, which also coincides with the date the group claims the attack occurred. In their announcement, the threat actors have initiated a countdown timer, a tactic used to create a sense of urgency and pressure the victim organization to establish contact. The group has issued a warning that the stolen data will be published if their demands are not met. To support their claims of a successful intrusion, the group has provided evidence in the form of SQL database code snippets allegedly extracted from the institution's internal systems.

Evidence and claimed data types

The evidence provided by the Everest group includes screenshots displaying SQL code fragments. These fragments contain database query structures and specific file paths that appear to reference banking operations, such as 'DDA_BANK'. This type of evidence is commonly used by ransomware groups to demonstrate the depth of their access within a network.

While the specific volume of data or the exact file count has not been disclosed by the group, the listing identifies the following types of affected information:

• Financial transaction data
• Database records

Organization profile: Citizens Bank

Citizens Bank is a major U.S.-based financial institution providing retail and commercial banking services. Headquartered in Rhode Island, the bank operates through an extensive branch network and digital banking solutions.

Analysis and implications of the threat

The Everest group is a Russian-speaking threat actor that has been known since 2020 for its involvement in data exfiltration and extortion activities. By utilizing double-extortion tactics—where attackers both encrypt data and threaten to leak it—the group significantly increases the pressure on an organization to comply with ransom demands. This method poses a direct threat to an institution's operational continuity and reputation.

This alleged breach may increase the risk of identity theft and financial fraud for Citizens Bank customers. Given the institution's U.S.-based operations, a confirmed data breach could trigger significant legal obligations under the Gramm-Leach-Bliley Act (GLBA) and various relevant state regulations. Furthermore, the leaked data may be utilized by malicious actors in secondary attacks or targeted phishing campaigns against the bank or its clients.

In such scenarios, organizations in the financial sector typically focus on robust defensive measures to mitigate risks. Common industry practices include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict network segmentation are critical steps to protect sensitive database records and financial transaction data from unauthorized exfiltration.