its always the same with these kind of things. cop to what your sure of and if you find out more later, make an addendum to your previous findings.
if they're sure someone was running select * from account_info, then they're sure your personal info like name, address, account_name, security_question, etc was taken. If they person had access to run that then they might have also had access to the stored credit card info.
once you've done a few of the RCAs the level of disclosure and time make perfect sense.
better safe than sorry though, so im having my debit card re-issued. yay.
if they're sure someone was running select * from account_info, then they're sure your personal info like name, address, account_name, security_question, etc was taken. If they person had access to run that then they might have also had access to the stored credit card info.
once you've done a few of the RCAs the level of disclosure and time make perfect sense.
better safe than sorry though, so im having my debit card re-issued. yay.