My Citi AA Visa was similarly compromised last month. But the new card arrived in the mail, and I had about a 3 week period to call to cancel the old and activate the new. too was frustrated that they blamed a merchant database breach, but would not divulge the merchant.

There's a thread about this in the "other credit card" forum.