FWIW, a compromise at Citibank is not the most likely way for that to have happened. It is more likely to be a large third-party compromise (many organizations manage to lose X00,000 cards in an incident) which gets reported to Visa/Mastercard per the PCI procedures. Those reports get fanned out to issuing banks, which often will take proactive steps to limit your liability, and by extension their own.

Make sense. Thanks.