Another data point, although I have no proof that this is from Rakuten.
Got a call from Chase Fraud Dept today, with the following unrecognized charges:
06/28/2013 Pending YAHOO *WALLET $1.00
06/28/2013 Pending PAYPAL -$1.00
06/28/2013 Pending PAYPAL $1.00
06/28/2013 Pending RN * $1.00
My last use of Rakuten was 3/21/2013 ... so it's been 3 months. No idea if it's related.
Upon looking a bit more, I noticed I did use Buy.com on 6/4/2013 that went on this credit card, but it was through PayPal, so the number should have been protected from that.
when you use a card with them, they store the card info to your account...all of the information including the 3 digit security code. it doesn't matter when you made the purchase, if you didn't delete the information from your account that they automatically stored, they ALWAYS had access to it.