Somewhere along the food chain of CC usage - from the retail (think TJ Maxx - still remains the largest breach in history) to the process companies (think an outfit owned by Wachovia 2 years ago) to the banks themselves - there can be any kind of security breach anywhere in the whole food chain that could affect a large number of cards. The banks just doing rolling replacement when reports coming in. Happened all the time.