JPMorgan, Citi, Morgan Stanley client data may be exposed by vendor’s hack, NYT reports