In reply to David.

I don't think the attack was very sophisticated - you punched in your credit card numbers on their homepage, and THEN they sent it to the payment provider. So all I have to do is write a little code to send the CC number to me, and that's it. Not very sophisticated.