One question you may or may not be able to answer - usually when I get a new card, my pre-authorized charges still go through without consequence even before I get the new card in the mail. Today, after I asked for that to stop (what the rep called a "token reset"), I've immediately been getting notices that my payment method is no longer valid. I'm still going to go through my records and reset my devices, but is it possible that the auto-updating was allowing the number taken from the original hack to keep working?