I would also do a full virus/malware scan on your PC as well. To get your credit card info they must have got it from your PC or else found somehow in the real world. What virus/malware software are you using that may have let this get through? Malwarebytes is very good https://www.malwarebytes.com/ and there is a free version you can get to scan your PC. It would be bad for this to just happen again.