I just had this unfortunate experience yesterday.
I received a text from my bank asking about suspicious activity on my card. Rather than answering the text, I logged into my card account & found three charges I didn't initiate. I was able to dispute the charges online & report the fraudulent activity. The bank immediately locked & cancelled that card & reissued me a new card.
I'm now trying to track down what happened. The only online purchases I've made lately was too midway, amazon & a national plumbing supply house. I haven't ordered anything from BPI in a long time. I do have an online account with them but haven't received any notification from them of a data breech.
Maddening to say the least!!