You ask how your credit card details could have got into the hands of fraudsters. One route is by using your card at a retail outlet where the details are 'skimmed' when you use the card. (At one time, there was a major scam where lots of independent garages, and even a few within the big chains, were secretly recording the details of all cards which passed through their hands. These details were then sold on to fraudsters.
At other times, lax security within a legitimate company can lead to the potential loss of data. For example, I used to work on the railways. Each day, details of tickets ordered by phone (but to be collected at the station ticket office) were faxed through, along with the credit card details of the purchaser (so that he could use his card as identity when collecting the tickets). Quite often the ticket office fax machine was busy, or out of order, so the information was faxed through to me in the station supervisor's office. That meant that I regularly received long lists of credit card details, including names, card numbers, expiry dates and security codes (from the back of the card). When I was busy, those faxes could often lie around on my desk for hours before I had time to take them to the ticket office. My office was often left unstaffed and any colleague (or member of the public) could easily nip in and take a photocopy of the fax. (I always tried to keep those faxes secure but other supervisors were less diligent. Even then, a fax could have come through while there was no supervisor in the office, and be copied by a colleague before the supervisor was even aware that the fax existed).
Such poor security practices are probably quite commonplace in many organisations, so it's hardly surprising when credit card details are diverted to fraudsters.
Chris