Credit card info stolen and used despite new card.

I have had this card for over 4 years, and have had next to no issues.

However, a couple weeks ago, someone tried to use the card number online for all sorts of random purchases. I contacted the bank and got a new card issued, with a new number, and there were no more issues.

However, yesterday, I paid off the card, so it had no balance on it. Within 12 hours, someone (presumably the same person) had filled the entire account balance to the maximum.

This card has never left my possession and has never been used online, so I don't know how they got the number. But my bigger concern is the fact that they immediately maxed it out the second it was paid off, despite an entirely new account number.

How can this possibly happen? The card was brand new and I hadn't even used it yet.