As it seems to me, in fact everything is much simpler and trivial. In our time, it's not at all necessary to be a hacker in order to commit a "hacker" attack. Everything is done by employees of banks or payment systems. Someone somewhere can copy the necessary base, and give to the right people who will start to stamp fake cards. Stealing data from within is a million times easier than getting them to break into the Internet, because the technical issue has long been perfected.