Apparently, sometime in 2007, systems containing captured credit card information at a provider to Bike Nashbar were compromised and millions of credit card numbers were stolen.
Last summer I was getting charges for some scam called "Google Moneywords" being posted to the same credit card number. I then looked online and found the connection between these charges (from some offshore company) and the fact that other customers of Bike Nashbar were getting hit with the same charges.
The credit card company (Chase) acted like this was utterly unique and it never heard about this scam. It took me several hours and escalating through several levels of security people to get the fake charges dismissed. They acted like I was on trial, and I had to finally get the credit card number deleted and reissued.
I'm suggesting that credit card fraud can happen from anywhere. This did not even involve an online transaction. I used that card number once to buy a pair of bike shorts from Nashbar in early 2007 and I called that order in.