This is a bank, and they are regulated. Depending on the information shared, this may be a breach of that regulatory code.

I do not have access to see what the data is, but would certainly in their shoes investigate with high priority, and Would raise a security incident to do so. If it turns out to be empty and of no concern, then great. But ignoring such things is seldom wise.