Names, account numbers and contact information of some 200,000 US Citibank customers have been stolen by hackers.
Credit card security codes and date of birth details were not compromised, according to a statement by the bank to the Reuters news agency.
"We are contacting customers whose information was impacted," the bank said.
It said it had deployed "enhanced procedures" to improve security, but did not detail how the breach occurred.
Sophos senior consultant Chester Wisniewski said in a blog attackers may use the details to launch social engineering and phishing attacks against customers.
"Customers affected by this incident should be on high alert for scams, phishing and phone calls purporting to be from Citibank and their subsidiaries," Wisniewski said.
Citibank had begun informing customers of the breach.
