IME, It's very, very, very common for law enforcement to be the ones that first detect signs of a breach and track it back to the affected company, at banks and elsewhere.