[papln]

You might (justifiably) not like it, and it might inspire you to boycott the business or plead for regulatory relief, but it's not an "incident" from their perspective to be intentionally doing what they do to run their business.

[buro9]

This is a bank, and they are regulated. Depending on the information shared, this may be a breach of that regulatory code.

I do not have access to see what the data is, but would certainly in their shoes investigate with high priority, and Would raise a security incident to do so. If it turns out to be empty and of no concern, then great. But ignoring such things is seldom wise.