Bank account number, name and address can be enough to setup a direct debit or initiate a withdrawl (in specific circumstances). Keep in mind that you are less worried about the company itself being evil, than the possibiliy of this data leaking and being seen by a less scrupolous entity.