It could have happened anywhere up the "chain" from the driver, to the processor, and so on. Unfortunately, this has happened to me with different merchants, and other than being vigilent, and following up with the vendor if you can catch the thugs (and of course, the fraud reporting), there's not much that you can do.