Frost Bank is facing a Frost Bank lawsuit wave in 2026, driven by proposed class actions over a ransomware attack on a third-party software vendor that exposed the personal information of roughly 191,848 customers. Two putative class actions filed in Texas have been moved to federal court, and a separate proposed class action targets the vendor itself. Older matters against the San Antonio-based bank include a dismissed overdraft-fee class action and an ongoing employment retaliation case brought by a former investment adviser.
What the 2026 Data Breach Exposed
The breach did not happen on Frost’s own network. It occurred at Sefas Innovation, a software vendor that handled document composition and customer communications for the bank. Unauthorized actors accessed a secure file transfer protocol server used by Sefas for software support, with intermittent intrusions between December 2025 and April 2026. Sefas learned of the breach on April 16, 2026, and notified Frost on April 22.
The files taken included names, addresses, Social Security numbers, taxpayer identification numbers, account numbers, dates of birth, loan numbers, tax information forms, and bill-pay check images. Texas regulators reported at least 191,848 individuals affected. The Everest ransomware group listed Frost on its dark web leak site in April 2026 and claimed to possess more than 250,000 Social Security numbers tied to Frost customers.1Cybernews. Everest Ransomware Frost Citizens Bank Breach2UpGuard. Frost Bank Data Breach3Teiss. Close to 200,000 Frost Bank Customers Affected by Sefas Security Breach
Sefas filed data security incident notices with Texas and California regulators and offered affected individuals 12 months of complimentary credit monitoring and identity protection through CyberScout, a TransUnion company.3Teiss. Close to 200,000 Frost Bank Customers Affected by Sefas Security Breach
The Class Actions Against Frost Bank
Attorney William B. Federman of the Oklahoma City firm Federman & Sherwood filed two proposed class actions in Bexar County, Texas, on behalf of Javier Hinojosa of Amarillo and Renard Donaie of Baytown. Both petitions allege negligence and breach of implied contract, claiming Frost failed to implement adequate cybersecurity safeguards and was slow to notify affected customers.4San Antonio Express-News. Frost Bank Data Breach Class Action Lawsuit5American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach
One of the petitions cited the Everest posting and alleged the breach compromised over 380 gigabytes of files and millions of database records, including passport numbers and credit card information. Frost has not confirmed those categories. One named plaintiff said he had to cancel his debit card at least four times because of unrecognized charges and saw an increase in spam after the breach.5American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach
Frost removed both cases to the U.S. District Court for the Western District of Texas, where they were assigned to Judge Jason K. Pulliam. Hinojosa carries federal case number 5:26-cv-03407 and Donaie is 5:26-cv-03405. In early June 2026, Magistrate Judge Elizabeth S. Chestney gave Frost until July 10, 2026, to respond.6PACER Monitor. Hinojosa v. Frost Bank7PACER Monitor. Donaie v. Frost Bank
A separate proposed class action was filed against Sefas Innovation directly in the U.S. District Court for the District of Massachusetts in May 2026, associated with the firm Milberg PLLC. It accuses the vendor of failing to safeguard client customer data.8Law360. Citizens Bank Customer Says Software Vendor Leaked Info
No settlement has been reached or proposed in any of the data breach lawsuits as of mid-2026. Frost has said it does not comment on pending litigation.4San Antonio Express-News. Frost Bank Data Breach Class Action Lawsuit
What Frost Bank Has Said About the Breach
Frost spokesman Bill Day issued a public statement on April 22, 2026, confirming the bank had been notified by a third-party vendor of unauthorized access to the vendor’s systems that “may have included Frost customer data.” He said “there is no evidence of unauthorized access to the Frost network” and told customers they could safely continue using Frost services. The bank engaged cybersecurity experts to help investigate.9Yahoo Finance. Frost Bank Hit With Class Action
As of late April 2026, Frost had not filed a public disclosure of a material cybersecurity incident with the SEC, and the class complaints allege the bank was slow to directly notify affected customers.5American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach
The Overdraft Fee Class Action Was Dismissed
In April 2024, Frost customers LaNita Criswell and LaSheena Neal filed a putative class action in the Western District of Texas accusing Frost of charging $35 overdraft fees on transactions that did not actually overdraw their accounts. The complaint said the proposed class included at least 100 customers with combined claims exceeding $5 million.
Frost moved to compel individual arbitration under the deposit agreement’s arbitration clause. Magistrate Judge Chestney recommended in August 2024 that the plaintiffs arbitrate individually rather than proceed as a class, and Judge Xavier Rodriguez adopted that recommendation in September 2024. When the plaintiffs chose not to pursue individual arbitration, Judge Rodriguez dismissed the case in March 2025. Frost said it had already eliminated the specific fees at issue in 2023 and had previously stopped charging nonsufficient funds fees.10San Antonio Express-News. Frost Bank Overdraft Fees Lawsuit Dismiss11PACER Monitor. Criswell et al v. Frost Bank
Employment Retaliation Suit by a Former Adviser
Chad Jones, a former investment adviser who worked at Frost from March 2017 to February 2025, sued the bank and two named employees in April 2025 in the Western District of Texas, San Antonio Division (Case No. SA-25-CV-00361-JKP). Representing himself, Jones alleged retaliation, defamation, wage and hour violations, discriminatory assignment of referrals, and malicious conspiracy. He said he was “silenced, scapegoated, and deprived of a fair investigation” after reporting that colleagues mishandled transactions and falsified records. He sought $5 million in compensatory damages plus punitive damages and unpaid wages.12Banking Dive. Ex-Frost Employee Sues Bank Over Labor Violations13Yahoo Finance. Ex-Frost Employee Sues Bank Over Labor Violations
In January 2026, Judge Pulliam granted in part Frost’s motion to compel arbitration, sending Jones’s non-statutory claims to arbitration. In May 2026, the court dismissed his remaining statutory employment discrimination and retaliation claims under Title VII, the ADEA, the TCHRA, and the ADA because Jones had not first filed charges with the relevant agency before suing. The case was administratively closed while the non-statutory claims proceed through arbitration.14Justia. Jones v. Frost Bank
Older Matters That Have Closed
Several earlier lawsuits against Frost have already concluded and are no longer open to new claimants:
- A 2020 class action by Houston business owner Edward L. Scherer alleged Frost unlawfully limited Paycheck Protection Program applications to existing customers with business checking accounts. It was dismissed with prejudice by agreement on June 30, 2020, after the second round of PPP funding addressed the concerns.15PYMNTS. Class Action Lawsuits Banks PPP Loans16CourtListener. Scherer v. Frost Bank
- A Sarbanes-Oxley whistleblower complaint filed by Vinay Yadav was dismissed by an administrative law judge for failure to state a claim and untimeliness. The DOL’s Administrative Review Board affirmed in June 2021 and denied reconsideration in July 2021.17U.S. Department of Labor. Yadav v. Frost Bank, ARB Case No. 2020-0048
- Roy G. Clarke sued Frost and a law firm in the Western District of Texas after an El Paso appeals court invalidated Frost’s attempt to revive a 13-year-old dormant judgment against him, finding that the bank had failed to properly serve required documents. The federal suit ended in April 2025 through a confidential settlement.18DTD Firm. Frost – Roy G. Clarke v. Frost National Bank
- Non-practicing entity Caselas LLC asserted 23 patents against Frost in the Western District of Texas covering electronic payment processing, card transaction systems, and digital banking infrastructure. The case ended in January 2025 with a joint dismissal with prejudice, each side bearing its own costs.19PatSnap. Caselas LLC v. Frost Bank Payment Systems Patent Dispute
If you received a Sefas or Frost notification letter about the 2026 breach, you are within the group the pending class complaints seek to represent. No class has been certified and no settlement has been proposed, so class membership and any recovery depend on how the Hinojosa, Donaie, and Sefas cases develop in the courts named above.