The very first time? No other transactions what so ever at all! No online transactions, such as putting a deposit on your disney vacation? Absolutely no one else ever handled or saw that card in any way? If that is truly the case (I'm not doubting just trying to follow your timeline) then there was NO other way for a criminal, cyber or otherwise, to get your info. So that would definately make one wonder.