I got a letter from my bank a few weeks ago about a company they used to do email marketing that got hacked. It wasn't really clear in the letter what they were trying to tell me but I had a pretty good idea from all the disclaimers I got with my account that they were free to share my contact information with third party companies they may use for marketing purposes. They assured me they don't share any other personally identifying information like my account numbers, balances or social security number.
I got a call from my bank not long after this. My first response was to tell the caller that I don't discuss my banking over the phone. He assured me that he was calling to give me information, not to get information from me. So I said, go ahead. Then he needed me to confirm my address. At that point I repeated that I was not interested, thanked him and hung up.
It may seem paranoid, but I believe in erring on the side of caution on line and on the phone. Only when I contact my bank myself with a call or via email will I share any information. I will never click through a link from an email, I will never call a phone number from an email. I go strait to my on-line banking or credit card site and contact them using the contact info they provide.
You can't be too careful now days. Especially when your bank and credit card companies are sharing your information with third parties.