FWIW, it didn't necessarily happen in the hotel room. RFID chips in CC can be read by scanners that are in close proximity to the CC (few feet away) and the info cloned to a blank card and used nefariously elsewhere. Do you and your GF have
for your CCs and Passports? If so, then it most likely (read on for my own experience with this) happened in your hotel room. If not, then it probably did not happen in the hotel room. I use these, and as much as I try to protect them, one was still stolen and a card cloned. I get text messages anytime more than $5 is charged to my card.
I gave my CC to a restaurant server in Vail, CO and while she was running my CC a text message came in as it usually does, which I always check but it wasn't the restaurant's charge, but instead a charge from an Apple Store in Florida for over $1000, another 30 seconds a second text message came in for the restaurant charge. I called Visa immediately and reported the fraudulent Apple Store charge and the valid restaurant charge. They did tell me that it was a point of sale charge with the card, so I know it was cloned and they confirmed that was the case since I had the card on me. Other than that, I don't know what happened as the CC fraud people never tell you, but hopefully they caught it before the person got out of the Apple store. Card was closed and I was not liable for the fraudulent Apple Store charge.
Brazil is one of the worst places in the world for Credit and Debit Card fraud. I've been there a half dozen times and it, along with Mozambique, are the two countries I will not use my ATM card. I exchange USD for local currency and only pay for the hotel with my CC. I also lock up my wallet, passport, and travel folio along with my laptop when leaving the hotel room no matter where I travel. When traveling internationally I do not use my regular wallet, but instead I use a business card holder with cash, passport card, photo copies of passport, and in the case of other countries a Credit or ATM card, whichever is actually needed while I'm out. AND, I carry it in my front pocket. Having traveled the world for over 50 years I've been very lucky and not been successfully pick pocketed (encountered a few failed attempts), YET.
Good luck on finding out what happened, but the CC fraud people won't tell you anything, and I doubt the hotel will find out anything either. Enjoy the rest of your travels.