Stolen passwords and credit card data
Hello there!
At the beginning of summer, my buddy saw an instagram story on my profile but it wasn't uploaded by me. It was a scam post using Mr Beasts alias. I checked the logins, and as it turns out, someone loggid in from Turkey. I was using an old password there, that was flagged 3 years ago as a stolen password by google, but I didn't care back then. Now, changed passwords at all the important sites where I used that and set up 2FA (facebook, instagram, google etc.). A few days later, my linkedin was hacked and someone added a trusted device and set up 2FA, locking me out of my account. I have used the same password there, so changed that with the help of customer service.
After a while, some logins were detected on my riot games account, changed the password immediately.
The problem is that 2 months later my other frequently used password (which I created after stopped using the previous one) also got leaked somehow, so I had to start over and create individual passwords for all sites (I know I should have been doing it before, little did I know back then...).
Changed everything, set up 2FA. After another month, my card was used for anauthorized purchase and the confirmation email showed the logo of shop.app. They say the site wasn't breached, but someone got my email and card data and placed an order through this shop.app and the system pulled it in. But my card detalis were saved there.
My question is, how could someone get my card data and passwords??? Never gave it away, never placed orders on suspicious sites, could it have been some virus or keylogger or something placed on my computer? Windows defender never found anything, since then I bought bitdefender which stopped some connections, but I'm not sure.
I just want to how this could have happened and how I can prevent it from happening again.