I cant say for certain, but I do know that it’s likely card number algorithms can be compromised in one way or another. I had a credit and debit compromised one day after another, the credit card having never been used at all. I had them both cancelled and reissued immediately, and after activating the new credit card it was done again the very next day. These were from the same bank, a small credit union based in Eastern Washington.

Again, it was cancelled, they told me it was an algorithmic attack, and the next card that arrived was activated and had no further issues despite use in person and online until it expired.

Maybe they were saving face after a breach, but that kind of attack felt far more likely given my lack of usage.