Both banks deny their networks were breached. Experts say the data likely points to a single vendor that was compromised.