‘Since it was the vendor that was hacked, we are letting them and our bank’s fraud department lead any investigation,’ the group’s spokesperson said