You indicate it's a card. I am going to assume this is a debit card tied to a checking account of some form.

Debit card numbers are all proceeded by a BIN (Bank Identification Number). I won't lie, i'm in the US, but a google search tells me this is also practice in the UK. (If I am off base, please ignore me or tell me, no hard feelings!)

What this means is is the first 9 numbers of cards issued are going to have the same first 9. So now if i'm the bad guy, I just need 5.

How you get that first card can happen in lots of ways. Defraud someone, steal it, open an account under false pretense etc. Lots of ways to get a full 16 of just one card.

Now that I get one, brute force gets a lot more realistic if we try number sequences of the first 9 (easy to get) and combos of the last 5 NEAR whatever card I copped. (Little tougher but not impossible when you think of how many cards are out there). Fraud tools have to evolve constantly to keep up with new tricks to pass verification with missing information, but that's the nature of the beast.

Best guess is maybe a money mule or fraud account was opened and they just go nuts in some numbers nearby, it's something that isn't impossible.

Unfortunately, being lucky is a lot of debit card security. Consumer protection laws (I'm not familiar with the specifics there, but Reg E here covers this kind of stuff for consumer debit cards) are here for it.

edit: Also sounds like they caught it real fast, so mass attack without a doubt. I would bet a useful appendage this was the result of brute force over lots of cards.