It was a sophisticated hack too - the credit card company said that I had authenticated the transaction from my mobile phone, using a passkey! The hacker had booked a two room apartment for one night in Athens, Greece, using a website I've never used. I received a booking confirmation for the apartment, so I phoned the contact number, using an encrypted phone, which doesn't display my number. The person who answered the phone seemed genuine and was confused, as no one had shown up to the apartment to stay! Whatever the story, it's obviously a scammer "testing the waters", to see if the credit card and email worked, before going for a much larger sum! Fortunately, I'm notified for every credit card purchase I make, with push notifications on my phone.
The SDE shop doesn't contain any of my credit card or personal details - only my order history. So any leak from them must come via the Shop.app. And yes - you actually have to apply to Shop.app to opt out of them sharing all your information for targeted advertising etc! Which takes up to seven days! I never opt in for any information like this, so anyone with a Shopify or Shop account should check their data and privacy settings. And I've deleted the credit card they had on file.....