The bank wrote to customers on April 22 telling them their account details may have been compromised and that their cards needed to be replaced.
A letter stated that because of the "high risk compromise to your account" customers' cards would be blocked if they did not contact the bank by April 29.
A customer told the Sunday Herald Sun the letter was dated April 22, but he did not receive it until seven days later.
A Westpac spokeswoman said the breach was an example of "a common point of purchase compromise where a single vendor has broken security".
She said criminals sometimes waited years to use stolen credit card numbers so there was no way of knowing when the theft had occurred.
She said the breach had taken place overseas.