Citigroup (Citi) data breach history (2016-2026): notices, vendor hacks and the New York lawsuit
Citi’s recent security headlines are a mix: breach notices filed with state attorneys general, a mortgage-vendor hack that named Citi among affected banks, and a New York lawsuit saying Citi failed to stop account takeovers. This page keeps them apart and marks what is confirmed.
Short answer
Was Citi hacked?
We found no confirmed hack of Citigroup’s own systems from 2016 to 2026 in the sources we read. Citibank did file a data incident notice with the Massachusetts Attorney General on 24 July 2025, and a class action followed; the complaint alleges unauthorised actors reached names, account and debit card details, dates of birth and Social Security numbers. We could not read Citi’s notice itself, so the cause is not confirmed here.
Two incidents came through vendors: the November 2025 hack of the mortgage vendor SitusAMC, where Citi was among banks reported to be affected, and a notice dated 6 October 2026 about a service provider that mails customer communications (seen via search). In January 2024 New York’s Attorney General sued Citibank, alleging weak defences against account takeovers; a judge let the case proceed in January 2025.
Timeline at a glance
6 Oct 2026Citibank notice: incident at a mailing service provider; names, addresses, account numbers (via search). (Massachusetts AG (via search))Reported
22-24 Nov 2025NYT/Reuters: Citi among banks whose client data may have been accessed in the SitusAMC hack. (Reuters)Reported
7 Aug 2025Class action filed after Citibank’s late-July 2025 data incident notice. (Bloomberg Law)Reported
21 Jan 2025Judge denies Citi’s motion to dismiss the New York AG’s account-takeover suit. (PYMNTS / Reuters)Confirmed
30 Jan 2024New York AG sues Citibank over failures to stop and reimburse electronic fraud. (New York AG)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Citigroup incident timeline, in detail
Confirmed = acknowledged by Citigroup, a regulator filing or a court. Reported = credible reporting Citigroup has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug – Oct 2026ReportedThird-party / print and mail vendor
Mailing service provider incident: Citibank notifies customers
What happened. Search results show a Citibank notice dated 6 October 2026, filed with the Massachusetts Attorney General, saying Citi learned on 13 August 2026 of a security incident at a service provider that supports the mailing of customer materials. We could not open the filing (via search).
Impact. Per the notice as summarised in search results: names, addresses and account numbers, without the associated security code. Citi reported no sign of misuse and offered credit monitoring. No count was given.
SitusAMC vendor hack: Citi named among possibly affected banks
What happened. SitusAMC, a vendor to real estate lenders, said it was attacked on 12 November 2025 and that data on some clients’ customers may have been affected. The New York Times, cited by Reuters, reported that client data of JPMorgan Chase, Citi, Morgan Stanley and other banks may have been accessed.
Impact. Citi declined to comment to Bank Info Security. No Citi customer count appears in the sources we read.
Jul – Aug 2025ReportedUnconfirmed cause / notice and litigation
Citibank data incident notice, followed by a class action
What happened. Bloomberg Law reported on 7 August 2025 that a federal class action was filed in Manhattan over a Citibank data breach reported in late July 2025. The plaintiff alleges unauthorised actors accessed customers’ names, email addresses, account and phone numbers, debit card information including PINs, dates of birth and Social Security numbers.
Impact. These are the plaintiff’s allegations. We could not read Citi’s own notice (filed in Massachusetts on 24 July 2025, via search), so the cause and the number of people are not confirmed here.
Jan 2024 – Jan 2025ConfirmedRegulatory / state AG lawsuit
New York AG sues Citibank over account-takeover fraud defences
What happened. New York Attorney General Letitia James sued Citibank on 30 January 2024. The suit says Citi did not respond to red flags such as unrecognised devices, new login locations and password changes, did not block transfers that pull money from several accounts and send it out quickly, and wrongly denied reimbursement under the Electronic Fund Transfer Act. One example: a customer clicked a texted link, a scammer changed her password, enrolled in online wires and sent $40,000.
Impact. The AG seeks restitution, penalties and stronger anti-fraud controls. On 21 January 2025 a federal judge denied Citi’s motion to dismiss, finding the EFTA applies to unauthorised wire transfers from consumer accounts. Citi said it was disappointed. No outcome was found in the sources we read.
July 2025 incident: the detailed data list comes from a class complaint, not from Citi. Until Citi’s notice is read, treat it as alleged.
Older Massachusetts notices (a 2022 card account incident and a January 2023 letter about an employee and debit card data) appear in search results, but we could not open them, so they are not listed as incidents.
The pattern across the record
Account takeover is the live risk for customers
New York’s suit is about scammers taking over accounts with phished credentials and moving money by wire, and whether the bank’s controls should have stopped it.
Vendors hold Citi customer data in bulk
A mortgage processor and a mailing provider each held Citi customer records. Citi’s 2011 online-banking breach predates this window and is not covered here.
What it means for Citigroup For Citi customers and cardholders — and what to do
Whether or not you got a letter, the account-takeover pattern in New York’s lawsuit applies to every online-banking customer.
1.Never act on a texted “Citi” link
In the AG’s examples, a text link led to a changed password and a wire. Open the app yourself or call the number on your card.
We found no confirmed hack of Citigroup’s own systems from 2016 to 2026 in the sources we read. Citibank filed a data incident notice in July 2025 that led to a class action, and Citi was named among banks possibly affected by the 2025 SitusAMC vendor hack.
Citibank data breach 2025: what happened?+
Citibank reported a data incident to the Massachusetts AG on 24 July 2025. A class action filed on 7 August 2025 alleges names, account and debit card details including PINs, dates of birth and SSNs were accessed. Those are the plaintiff’s allegations; Citi has not described the cause in any source we read.
Was Citi affected by the SitusAMC breach?+
The New York Times, cited by Reuters, reported in November 2025 that Citi client data may have been accessed in the SitusAMC hack. Citi declined to comment.
Why did New York sue Citibank?+
In January 2024 the New York AG alleged Citi failed to protect customers from account takeovers and wrongly refused to reimburse stolen funds. A judge let the case proceed in January 2025.
Is there a Citibank data breach settlement?+
We found no settlement for the 2025 class action or the New York AG suit in the sources we read.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Citigroup. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.