US community bank says thieves drained customer data through third party hole