Nasty, if the card details are not stored on their system, the data must have been captured in real time similar to the target attack which scraped the memory of the server. I would have thought that they would have used a method to monitor changed files, but with an attack of this level, it is not that easy.
I would be completely furious if I had been ripped off by thousands of dollars.

I left WooThemes about 4 years ago when they told me that they never tested any of their themes on a server where they could check the errors to see if the theme generated errors. That coupled with the fact that their address seems to be a PO Box in South Africa put me off their products. But such is life, I am a British National living and working in Asia.