FWIW, a compromise at Citibank is not the most likely way for that to have happened. It is more likely to be a large third-party compromise (many organizations manage to lose X00,000 cards in an incident) which gets reported to Visa/Mastercard per the PCI procedures. Those reports get fanned out to issuing banks, which often will take proactive steps to limit your liability, and by extension their own.