It IS kinda strange. I know someone with two cash rewards cards and they are both being changed (shows online he has 4 cards at the moment) I, however, have not received the email or additional account online.
What a pain in the *ss! Just found out today online an hour before going out for New Year's eve.
A potential problem for me (it may also possibly impact others here) was that I need to have over $650 in charges on my new Penfed AMEX before mid-January to get my 20K miles. I was a little lower than I thought - I had around $1,000 in charges - but now thanks to this mess it is split between 2 AMEX card numbers, neither one of which ALONE has over $600! Called and am having them send a letter (not just the generic BS form letter), that confirms I charged over the limit and got the miles.
I had a lot of respect for PenFed previously - now they're in the "wait and see" category.
EDIT - OK, now I see the email from them from a couple days ago. Still a pain in the *ss - I'd vowed to NOT check most email during vacation!
Also, I noticed that someone above posted that his (fairly new) Penfed VISA was included in the reissue - FYI, my much older one was not. Wonder whether the breach only involves fairly recently-issued cards?
I had a bunch of fraudulent transactions post to my PF Visa about couple months ago; all relatively small amounts <$100 total. Indeed, I came to know about it when the fraud prevention dept. called me about a charge which I obviously did not authorize; that charge was blocked in time by PF. That is when I noticed that a few unauthorized transactions had already posted. Anyway, they were all taken care of by PF and a new card was issued some weeks ago. And now THAT is being replaced by another one; have not received the physical card though.