I worked in banking years ago and while I can't remember the specifics now, the first four digits of a *credit card* signified Visa/MC/Discover, etc, the second four signified something else that escapes me at the moment, the third four signified your banking institution (each institution had its own number), and the final four ARE completely random. At least, that's how it was done about 15 years ago. Also, I may have confused the second and third set, but all four numbers were not random (back then). I do think that when I left the industry, they had moved to the last six being random, so the institution's number may have changed somewhat to accommodate that. Also, we didn't have the 3-digit code on the back at that point in time, either.
Debit card numbers were somewhat similar in structure, but back then, they were only ATM cards.
As for how OP's number was compromised, it could be a program, as others have suggested, or the place where the revolving charge (a charity, I think it was?) cold have been hacked, releasing those numbers.
I remember a story out of Canada a couple of years ago where one guy kept getting his number stolen and the bank didn't understand what was going on. They sent his card overnight and there were charges on it before he even got it. Then, the bank manager hand delivered it to him "hot off the press" so to speak, and there were charges on it. Turns out, an investigation revealed some hacker had discovered that institution's number-generating code and got the numbers randomly. Something like that. I was floored.
All in all, there is just no telling how these crooks get our numbers anymore.
Edited to add link:
Here is the link on the story I mentioned above. It's called "sequencing fraud" and is from 2015.
"Sequencing Fraud on 9 CIBC Visa Cards Like 'Groundhog Day' for Ottawa Man"
Fraudsters have technology to compromise both card numbers and 3-digit security codes, expert says.
https://www.cbc.ca/news/canada/sequ...s-like-groundhog-day-for-ottawa-man-1.2989611
I've not posted a link before so let me know if i need to make changes to this post. I tried to give some info but I'm not sure if I did it right.