There are hackers on the world wide web that have no association with our vendors. And they're dangerous. In 2017 alone I had to replace my debit card four times, at least. And also had to cancel a PayPal debit card that I had only used twice the previous year, didn't even carry it with me, it stayed tucked away under my desk calendar. The two different occasions it had been used online was many months previous to the incident before it was used to purchase over $800 in airline tickets by a hacker. These idiots have nothing better to do than send out bots to steal random credit info. They sometimes use number generators, which randomly spit out numbers - a complicated process, as my bank explained it to me - and occasionally "get lucky" and hit pay dirt with one of our card numbers. It's a never ending, vicious cycle. As easy as it is to blame the last vendor we purchased from, it's usually not the case. Not that all of them are blameless but in reality it's very unlikely that a well known business is going to steal from you immediately after you purchase from them, it's just too obvious, for one, and eventually it would ruin them (and probably not take long at all).
POS systems are hacked all the time. It's only been a few years ago that Home Depot was hacked; for one day, every purchase made in-store via card swipes yielded $10 for the evil geniuses hacking their POS system. Just imagine how many card swipes that is for a company that large in the United States and how much money that amounts to in a single day.
Just this past year one of our flavor vendors, Wizard Labs, had their payment system hacked. It wasn't them personally stealing from everyone who used their online payment system, it was whatever entity invaded their system. They now accept PayPal as a means of payment, as do a few of our other vendors, which provides a little more security for their customers.
I'm not denying that some businesses inadvertently employ assholes who steal from innocent customers. Unfortunately that happens too. But in a case like yours where a pretty large amount was taken, I'd be much more inclined to believe this incident was a "hit and run" by a random internet stalker not even associated with Fasttech who does this for a living.