Customers of American Express are being notified via letter that their account information might have been exposed in a third-party service provider's data breach.