As typically happens when credit card information is stolen, MasterCard is leaving it up to the banks that issued the cards to warn the cardholders. It declined to name the banks.

Those banks usually don't pass the information along because most pilfered numbers don't get used and because issuing new cards, as many customers would demand, can cost $35 or more each. If all 40 million cards were replaced, that might cost more than $1 billion.

"They could contain the damage," Litan said. "All they need to do is put a stop on those cards and issue new ones. But of course they won't do that because it costs too much money."

All credit card holders should carefully review their statements because they will be reimbursed only if they report errant charges. And some consumer advocates recommend requesting a new card as a matter of course as often as every six months to guard against fraud.

Although cardholders won't be liable for fraudulent charges they report, they risk having their credit score damaged as well as spending hours setting the record straight.

Mastercard says only 68,000 card users are at high-risk of fraud. Only?