I would report this to any other financial services you may use, including your employer. While it could be a simple hack and drain, there could be more going on.