The situation involves a General Motors-branded card, the Journal reported.
HSBC's U.K. office was not immediately available to comment.
The incident is the latest in a string of high-profile cases in which personal data were stolen from retailers or financial institutions.
More than 20 U.S. states are considering legislation after data security scandals involving ChoicePoint and LexisNexis.
ChoicePoint, a data collection company, said in February that data on 145,000 people was stolen from its consumer database, resulting in at least 750 cases of identity theft.
LexisNexis said in March that an intrusion into its Seisint databases may have compromised personal information on about 32,000 people--then this week it upped the estimate to 310,000.