They said it may have been compromised. Only the 3-digit code on the back changed, not the 16-digit number on the front.
Interesting. There are two three-digit codes on the back: a letter and a three-digit sequence number over on the left of the signature panel and the last four of the account number and the three-digit CVV code over on the right of the panel.
I just looked through a stack of old Discover cards. Sometime in the mid-nineties, they started printing the full account number on the back (four groups of four), followed by the three-digit CVV code. About 2005, they went to printing a letter, a three-digit sequence number, a patch of blank space, the last four of the account number, and the three-digit CVV.
Also, sometime around the middle of the last decade, they started the practice of sending out new cards with the same account number, expiration date, and CVV, with only an incremented sequence number. They've done it to me a bunch of times, never with any indication of fraud, but always some sort of pitch when I call the number to activate the new card. Obviously, a marketing ploy.
Most recently, they've started incrementing the expiration date by a month and also changing the CVV.
One thing to note: If a new card has been issued with the same account number, expiration date, and CVV, old cards with different sequence numbers should get declined when swiped (the sequence number is part of the swipe data). However, bad guys could still use the account online if they can guess the billing address. Typically, account number, expiration, billing address, and CVV is what you need online.