Based on your financial expertise, provide your response or viewpoint on the given financial question or topic. The response format is open.

MasterCard won't disclose who leaked my credit card details
As indicated in comments, this is common practice in the US as well as EU.  For example, in this Fox Business article, a user had basically the same experience: their card was replaced but without the specific merchant being disclosed.  When the reporter contacted Visa, they were told: "We also believe that the public interest is best served by quickly notifying financial institutions with the information necessary to protect themselves and their cardholders from fraud losses. Even a slight delay in notification to financial institutions could be costly,” the spokesperson said in an e-mail statement. “Visa works with the breached entity to collect the necessary information and provides payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring, and if needed, reissuing cards. The most critical information needed is the affected accounts, which Visa works to provide as quickly as possible.” What they're not saying, of course, is that it's in Visa's best interests that merchants let Visa know right away when a leak occurs, without having to think about whether it's going to screw that merchant over in the press.  If the merchant has to consider PR, they may not let the networks know in as timely of a fashion - they may at least wait until they've verified the issue in more detail, or even wait until they've found who to pin it on so they don't get blamed. But beyond that, the point is that it's easier for the network (Visa/Mastercard/etc.) to have a system that's just a list of card numbers to submit to the bank for re-issuing; nobody there really cares which merchant was at fault, they just want to re-issue the cards quickly.  Letting you know who's at fault is separate.  There's little reason for the issuing bank to ever know; you should find out from the merchant themselves or from the network (and in my experience, usually the former). Eventually you may well find out - the article suggest that: [T]he situation is common, but there is some good news: consumers do in many cases find out the source of the breach. But of course doesn't go into detail about numbers.