A US bank says a hack involving an employee’s email account has placed some of its customers’ information at risk.