I assume they had a fake CC form and collected the CC number and information on top of the charge. So that'd involve cancelling the card and compromised PII.