Tarzhaaaay was just publicized recently. Could have been anyone who handled your card and stole the number, or another insecure merchant.