U.S. banks are required by regulation to notify authorities about serious cyber incidents within 36 hours