A lot of different companies have had their databases hacked or otherwise stolen in the past few years -- most likely you just did business with a legit company that was lax about security. The same thing happened to me a couple of years back with my credit card, except that my credit card company actually called me first, because there were some unusual-looking charges. Unfortunately there's no way to figure out in advance which companies are safe, and often not even in hindsight (I still don't know which one mine got stolen from), but fortunately as long as you find out about it fast enough you're generally not liable for the charges.