I seem to have a card compromised about once every 5 years or so. I too am a creature of habit, buying mostly from the same local places and same online sites, although that hasn't always been true.
The very first time I had a card compromised was in the early days of Internet commerce. I bought a bunch of computer components from a bunch of online shops looking for the best price for each part (this was pre-Newegg and when Amazon still sold mostly books). I had a problem with one of the shops that sent the wrong product and didn't want to exchange it for the one I ordered and paid for. He stopped returning my calls so I left a scathing review at an online rating site. A week later my card started showing charges at porn sites. No proof it was him because I used that card at half a dozen other sites, but it was pretty suspicious.
I was a victim of the Home Depot hack a few years back.
Most recently, my main card that I've used for gas and groceries for the last 15 years or so was finally compromised for the first time. We went on two road trips this fall, filling up at several out-of-town gas stations. My guess is one of the pumps had a skimmer.