I agree with the seperate card. That was my seperate card and luckily the amount was not quite big because of that.

>Weak point was a password that lead to another merchant not using 3D secure

Well leaking a password shouldn't cause leaking a whole ass credit card data imo. The same data is printed on physical receipts the markets print, sometimes 4 digits, sometimes 10 digits. It's still possible to brute force from unattended physical receipts on the market.