I use Privacy cards for the majority of online commerce. If you aren't familiar with them, they generate one-off card numbers that obfuscate your financial details and become locked to the merchant of first use. They also can create single-use cards that deactivate after the first charge.
The card I have tied to my Epic account generated two fraudulent charges on Dec 10 at Spanish-named locations. The charges were blocked, as they didn't originate from Epic. On top of blocking the charges, Privacy deactivated the card number as they suspected fraud.
I've reached out to Epic for details, but they're just sending scripted meaningless fluff, and its been almost forty days.
Am I right to assume this means Epic was themselves the victim of some breach? I don't see any press releases or coverage of anything.
Could be Epic, could be privacy.com, or could be malware on your system. But every time I've tried alerting places they are leaking credit card #'s, I get the runaround or ignored. So I just assume it's on my end, take the necessary precautions, and let them figure out on their own if it's their problem.