I remember recently (within the last 2-3 weeks) reading about a credit card processor which had their database hacked, which affected several million users. Fortunately for me, I recently changed my debit card numbers for an unrelated matter, so no worries there.
There are several ways people can get credit card numbers from you these days. From what I've read, the RFID signal from your card can be remotely scanned, giving the crooks the info they need to give you a bad day. Simply using an ATM or card reader with one of these scanners hidden in close proximity will work, and I've read that they can even just scan the signal while the card is in your wallet.
http://www.snopes.com/fraud/identity/pickpocket.aspAnd then there are all of those bored Eastern European/Asian/other hackers that have nothing better to do than resell any information they can get their hands on on the black market.
Also, there may be undetected malware at work on your computer, so if you do online transactions with your card, there is always the chance that a keyboard sniffer may detect your information and then quietly send it out in a small packet to the bad guys while you are online. The place you placed your order through could have a similar infiltration on their system, capturing the information on their end before it gets deleted from their system.
Newer cards are not supposed to include the CCV number or your name in the rfid signal, but if you've had your card for a while, it might not hurt to get it replaced. You already have someone engaging in fraudulent activities with your card, so I'm sure your bank will have no problem issuing you a new number.