I was a bit exaggerative - the entire "development" arm of the bank had read only access to all customer financial data. One of the devs was a customer and pulled up all of his information.