That's the funny thing. Didn't it technically become a "needless and massive privacy breach" the instant the email was dispatched from their servers? Who knows who might've intercepted, read, or otherwise had access to it.

They definitely need to take responsibility at this point and contact all affected parties since there's no guarantee the data went unread.

Yeah, they will only suffer reputation loss if that email gets out further, you see!

The sad thing is, it seems your tongue-in-cheek comment is exactly their mode of thought.

Mind boggling, isn't it?

Banks think they can play by a different set of rules than anyone else because they have always been allowed to. Does "too big to fail" ring a bell?