According to the Daily Mail article linked above, they've known since mid-July. They could have issued a statement today if they wanted to. I can understand why they didn't do it earlier, to minimize the number of press cycles with their name attached to this incident.
But if this were my credit card company, I would be pretty irked to be finding out about it weeks after the company knew, from the news.
If this is the case, they should have had an announcement ready to go for yesterday. The absence of a response makes it seem like either they’re not taking the incident seriously enough, or they still don’t know the full scope and want to delay their announcement until then.
But if this were my credit card company, I would be pretty irked to be finding out about it weeks after the company knew, from the news.