Citigroup Global Markets Inc. data breach

What we know

Citigroup Global Markets Inc. is a premier global financial institution and major broker-dealer subsidiary of Citigroup, providing sophisticated investment banking, wealth management, institutional trading, and financial advisory services to corporations, governments, institutional investors, and high-net-worth individuals worldwide. Because of its central role in global capital markets and asset management, the firm routinely collects, processes, and maintains vast quantities of deeply sensitive financial and personal information. This repository includes high-value data necessary for executing complex transactions, verifying investor identities, managing portfolios, and complying with stringent federal and international regulatory mandates. In 2025, Citigroup Global Markets Inc. reported a significant cybersecurity incident to the Massachusetts Attorney General, highlighting growing vulnerabilities within the financial sector. Breaches affecting premier financial institutions frequently involve sophisticated cyberattacks, unauthorized intrusions into legacy or third-party database systems, or compromises within integrated financial networks. In the context of global investment and wealth management, threat actors actively target these networks to intercept confidential communications, exploit vulnerabilities in third-party vendor platforms, or gain unauthorized access to core financial databases where high-value client and employee records are stored. The exposure resulting from this security incident encompasses a dangerous combination of sensitive personal identifiers and high-value financial data, including full names, Social Security numbers, dates of birth, financial account numbers, routing numbers, and detailed investment transaction histories. When compromised, this specific category of financial data creates immediate and severe risks for affected individuals. Unlike simple retail data breaches, the theft of banking credentials, account numbers, and Social Security numbers exposes victims to sophisticated financial fraud, unauthorized wire transfers, fraudulent loan applications, and long-term identity theft that can devastate an individual's financial standing and credit health for years. As a federally regulated financial institution, Citigroup Global Markets Inc. is bound by stringent legal obligations to safeguard customer and employee data under the Gramm-Leach-Bliley Act (GLBA), state data protection statutes, and common-law duties of care. The GLBA mandates that financial institutions implement robust administrative, technical, and physical safeguards to protect non-public personal information against unauthorized access or foreseeable threats. The occurrence of a reportable data breach strongly suggests a potential failure in these mandated security controls, raising serious legal questions regarding whether the institution maintained adequate network monitoring, encryption standards, and vendor oversight. Receiving a data breach notification letter from Citigroup Global Markets Inc. serves as formal legal acknowledgment that your confidential information was compromised due to inadequate security measures. Under the law, this notification establishes legal standing to participate in a class action lawsuit aimed at holding the institution accountable for its security failures. Affected individuals do not need to prove that they have already suffered actual financial fraud or out-of-pocket losses to seek legal recourse; the increased, imminent risk of identity theft is itself a compensable harm. Our firm is currently investigating potential class action claims on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf. Given the massive scale of Citigroup Global Markets Inc.'s operations and the extraordinary volume of sensitive capital it manages, a security breach of this magnitude carries profound implications. Major financial institutions occupy a position of immense trust, and their failure to secure sensitive records undermines the stability and privacy that clients and employees rightfully expect. Pursuing accountability through class action litigation is a critical mechanism to demand institutional transparency, force necessary cybersecurity upgrades, and secure justice for all affected Massachusetts consumers.

See every breach reported in Massachusetts or read what to do after a ransomware attack.