The card you might have paid with is though. I can’t remember any instances of a card hack revealing transactions of customers though (I might be wrong, just doesn’t ring a bell).

It’s not a given that digital record must lead to compromise.