My data was breached from a company who I did not even know existed. When I asked them which of my financial institutions gave them my data, they ignored the request.

Attorney General: not our problem. Get a lawyer.
CFPB ← neutered by the GOP

There is zero consumer protection in the US for this scenario.

Indeed I cannot protect myself by pulling my money from the offending bank/CU because there is no law requiring the 3rd party to tell me where they got my data. And apparently no law requiring the company working for me to give me a breach notice if the breach notice came directly from the 3rd party who I have no contract with.

Interesting trivia along these lines: credit bureaus (and only credit bureaus) are required by law to tell consumers the source of their information. But they simply ignore this law because there is no statutory penalty for violating it. This is why your credit report lists your past addresses and other people tied to those addresses without stating the source of the info.

This is just to give an idea of the privacy shitshow with US banks. To have confidence in US banks is to be ignorant. It’s a good reason to shrink your banking footprint.