CULLEN/FROST BANKERS, INC.

Frost Bank based in San Antonio, Texas, a financial services entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-04-22 and reported on 2026-05-20. 191,848 Texas residents were affected. 200,271 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Financial Information (e.g. account number, credit or debit card number);Date of Birth. Consumers were notified via U.S. Mail.

Frost Bank notified Massachusetts residents of a cybersecurity incident involving unauthorized access to customer records. The breach compromised personal information including Social Security numbers and dates of birth. The bank provided affected individuals with guidance on obtaining free credit reports, placing security freezes, and filing fraud alerts. No police report was filed, and law enforcement did not request a delay in notification.

Frost Bank reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-05-20. The reporting organization type is Financial Services. 18 Vermont residents were affected. Categories of data breached: Social Security Numbers, Financial Account Codes, Credit and Debit Account Info.

Frost Bank reported a data security breach to the California Attorney General. The incident occurred on December 6, 2025. The notice template indicates that personal information, including identity and financial data, was potentially compromised. Affected individuals are offered credit monitoring services. Specific details regarding the nature of the breach, the number of affected individuals, and the discovery date are not provided in the available filing summary or the generic notice template.

Sefas Innovation, Inc. notified Frost Bank customers of a data security incident involving an SFTP server used for software support. Unauthorized access occurred between December 2025 and April 2026, resulting in the exfiltration of tax forms and bill pay images containing names, SSNs, and account numbers. Frost Bank was notified on April 22, 2026. Affected individuals were offered 12 months of credit monitoring. The incident is contained.

Frost Bank is a Texas-based financial institution and a subsidiary of Cullen/Frost Bankers, Inc. Founded in 1868 and headquartered in San Antonio, it operates across major Texas cities offering personal and commercial banking, wealth management, insurance, and investment services. As one of the largest independent banks in Texas, it serves individuals, businesses, and institutions within the United States financial services industry.