The particular compromise attempt in South Africa was reported on lots of Internet forums.

My assumption is that Coinbase or their card provider was breached. That happens and I get it, but the lack of action (the card is still active!) in response to repeated customer inquiry is evidence of a broken process.

How would email being compromised leak a debit card number? Can't think of any service I've used online in the last decade+ that would send me the full debit card number that way, or even make it visible when I sign in to their website.