Fraud

I applied  for a mazon credit card  before 12-31-21   and  it was placed  in my amazon account  right away ,  then was wait for the card in the us mail never got  the first card , then on 21-31-21  there was a email  saying Fraud protection from Chase card company. said there was use on 21-31-21 @ a Mcdonalds  ,I Reported that transaction to chase. They issued a second  card, was waiting for second card  ,got it on Satuday 1-8-22 and  was on my chase  account online ,saw a transcation  for gas   dated 12-31-21 for the second card by Chase/Amazon  ,so I canceled  this card ,sence  there might be more people with the card number ? How do these thefts  get the card number ,with out physcially having  the second  card in their  hands  .I had issued  later  this year and  Theft dated 21-31-21 the teft ? am confused  or they're  very smart   thieves ,makes me so mad