What's insane is thinking that a bank that handles people's money shouldn't be required to report a coordinated successful attack, regardless of whether their technology is at fault.
If all it takes is someone to download one of the countless publicly-available-on-github plaintext password compilations and automate login attempts to require a company to file a breach notification, I think all of the top services in the world would have to file one every hour.
There are thousands of coordinated successful phishing campaigns going on against Paypal every day, what value would that reporting provide to anyone?