Cullen/Frost Data Breach Exposes Sensitive Info for 4.6k Clients

Cullen/Frost Bankers Inc., the parent company of Frost Bank, disclosed a data breach that affected 4,698 individuals in the United States.

The breach was disclosed to the U.S. Department of Health and Human Services on March 26, 2026.

At this time, specific details such as the timeline and nature of the breach are unknown.

The breach involved protected health information, and although the specific types of information exposed remain undisclosed, could pertain to medical record numbers, health insurance identification numbers, diagnosis or treatment details, dates of service and healthcare payment information.

Frost Bank's response to the breach

Cullen/Frost Bankers reported the breach to federal regulators. Any correspondence from Frost Bank regarding this incident may contain specific details about the types of information involved and protections available to those affected.

Individuals who have questions or concerns about whether their personal or health information was involved in this breach can contact Frost Bank through its website or by visiting a local Frost Bank branch for more information.

Steps to take if your information was exposed

• Review financial account statements carefully. Check bank and credit card statements for any charges, transactions or account activity that seem unfamiliar.
• Request free credit reports at AnnualCreditReport.com and review them for unfamiliar accounts, hard inquiries or address changes.
• Place a fraud alert or credit freeze with each of the three major credit bureaus: Equifax (1-800-525-6285), Experian (1-888-397-3742) and TransUnion (1-800-680-7289).
• Monitor health insurance statements for any claims or medical services that were not received, as the breach involved protected health information.
• Be cautious of phishing attempts that reference Frost Bank or this data breach by name, including suspicious emails, phone calls or text messages requesting personal information.
• Report suspected medical identity theft to health insurance providers and healthcare providers if unfamiliar claims or services appear on insurance statements.