When companies share data, they tend to sell ALL of it, so likely the middle-man has a lot more info about you then you would suspect. Either that or there's another breach about to be announced. She has only used the card once in the last 90 days, and that was a in-person swipe.