I would argue the source of the information doesn’t matter. The bank disclosed a phone number of a customer to another customer.
[1]: https://www.oaic.gov.au/privacy/australian-privacy-principle...
Also APP 13 is tangentially relevant, for sure, but not the crux of it.
APP 13 is far less relevant than, for example, APP 11.