Sorry to hear about that.
I'm not sure if by having the "card cancelled" you mean 'account closed" or a new debit card # be issued to the existing account.
Assuming it's the latter:
I'd make sure that all
the contact info associated the account is correct.
Reset any 'lost password' challenge questions too.
Check to see that there isn't any fraudulent automatic bill payments in queue.
As a victim of identity theft, your Mom qualifies for a FREE fraud alert via the FTC
»www.consumer.ftc.gov/articles/02 ··· ud-alert
This will the single most important thing your Mom can do, IMO.
How did you determine the login data was the result of a phish?
If your Mom can't actually remember giving up her data to what proved to be a phish the possibility of a keylogger lurking on anything she uses for online access to her bank account needs to be considered.