Unfortunately I am very aware of how the details leaked since I've been in this industry for 20 years+ 😂
My interest isn't in how the cards got leaked, but how they both got leaked/used at roughly the same time... both cards are used in mostly unique places and both card details are typically only used via "larger" merchants like Grab, Lazada, etc. to limit exposure.
It could be coincidence, but I still find it interesting.
The other thing that was extra interesting was that on the primary card, the charges looked like they were at faked/spoofed merchants... example:
1) LAZADAMY - but charged from St. Louis
2) Digital Ocean - but charged from St. Louis
3) Netflix - but charged from St. Louis
4) Google - but charged from St. Louis
And so on... I think there were around 10 transactions of varying names, but all were 100% fake since the "real name" of the merchants (when they charge legitimately) are:
Google YouTubePremium Mountain View CA
DIGITALOCEAN.COM AMSTERDAM NH
NETFLIX PTE. LTD. Singapore SGP
So the fact that they knew (or had very lucky guesses) about what merchants I use, is interesting... because nobody else should have access to my list of merchants/transactions in order to fake the charges.
You're not alone — the same thing happened to me.
I had one fraudulent transaction charged to my supplementary card on 5/8, and then 16 fraudulent transactions attempted on my primary card on 8/8.
The charge on my supplementary card went through successfully, but all the transactions on my primary card were for USD $0.