An unnamed hacker in December “potentially removed” sensitive consumer data including Social Security numbers from the wholesale lender.