Merchants *should* use correct networking protections/encryptions when processing transactions. Some do not and you pay the price (literally!).
Sone cards have RFID chips (small "can be detected and automatically processed" chips) in your cards. Some can pick up those RFID data without your knowledge simply by walking close to you.
Or the "disk erase" was not complete.
If you are getting the impression that more than iTunes is a source of identify theft, you should be.
Pull a credit report immediately online, and you may need to "freeze" your credit (your SSN and identity will be locked and can only be unlocked using a password you set ... so DO NOT LOSE THAT PASSWORD ... the credit bureaus take "credit freeze" seriously.
Certainly you need to close your existing credit card (possibly ALL credit cards) and get new numbers.
Others think I may be overreacting ... I think that at least some of my advice is warranted.