The security breach took place between 20 and 22 October and affected other card providers, Abbey said.
Abbey began writing to customers last Friday inviting them to contact its fraud centre. It said it took action after receiving an alert from Visa.
Rob, an Abbey customer, contacted BBC News after receiving a letter from Abbey.
"I didn't believe the letter. I thought it was a scam."
"Personally I think it's shocking that it has taken a month to find out," he added.
Abbey said it was up to each individual bank to alert their customers, but that it had taken the decision to contact customers and cancel their cards as soon as it received the alert.
The bank was recently criticised for not alerting customers to a potential security breach at its online bank Cahoot.