Regulator warns that hacking could set off a bank run—or worse