I was looking at my bank website's certificate and discovered that it's issued to multiple websites, and the bank's domain name is only listed among many other domains in the 'alternative names' field.

Is this considered a bad practice? What risks are their customers subjected to? (man in the middle? impersonation?)



It is a certificate of a content delivery network – a U.S. company Incapsula Inc. – intercepting your whole communication with the bank. The certificate itself does not pose a direct risk to customers' data, but:


  Is this considered a bad practice?


Unlike the other answers, I would say it is not normal and the situation indicates a certain level of incompetence on the bank's side.


According to Incapsula's pricing plans, your bank might be using $59/month, while the company offers custom SSL for $299/month (feature "Supports custom SSL certificates") and a real plan for enterprises.
Even if the bank pays more to CDN, the bank is using functionality aimed at professional blogs and not using the features their plan/agreement offers.
Your bank may be violating privacy laws in your country by letting a company from another country, under a different legislature, process customers' personally identifiable data.



  What risks are their customers are subjected to? (man in the middle? impersonation?)


The data in a encrypted between your browser and the CDN's endpoint. The private key is (hopefully) stored only on CDN's servers, so there is no risk other companies from the list could impersonate the bank.

As long as security standards are met on a link between CDN and the bank, the MitM is technically not possible either.
