Comment by Expeck

While I agree that it is not due to skimming, I dont think it is database leak or breach. If it was, thieves would probably go for smaller transactions (since they are harder to notice ) on large scale. My guess is that she either got phished or shopped on compromised website. That could also explain hosting purchase.