Oh brother, this morning I login to Penfed and immediately notice my checking account is around $40 less than it should be, so I check the activity: 8 pending debit card transactions, all for $1 from "Uber San Franciso", and 4 posted debit card transactions from today & yesterday - 3 from Uber Amsterdam & 1 from a Christian Audio. So I dig the debit card out of my sock drawer & check the phone # on the back hoping there's a special # for lost/stolen - nope just the main Penfed #. So I call, takes at least 15 minutes to get a live person. The rep verifies the fraudulent charges are all debit card transactions. That's a relief to me as my Penfed checking account is one of my primary banking accounts, I have payments scheduled to debit the account.
I verify to the rep the last valid transaction is 9/14 for $700+ from PayPal, a payment on my PayPal MC. Rep tells me she has deactivated the debit card and will order a new one for me. I tell her "NO! Do NOT send me a new debit card, I do NOT want a debit card!". She agrees, and transfers me to the Fraud Dept. The Fraud Dept. Rep has me verify any fraudulent charges and rattles off a bunch I didn't see on my account as they were declined or a $0 amount. So I ask: "So why wasn't a fraud alert issued? I haven't used my debit card since June, on Amazon". She ignores the question and asks if I use the debit card on Apple Pay or Google Pay, or have it stored for payments online. I tell her "No, I don't use mobile payments and I don't pay anything with debit card, I use credit cards with $0 fraud liability." So she tells me the fraudulent charges will be reversed and if I want a new debit card I need to call back & request one, I repeat I do not want one.
So, I'm not impressed with Penfed, from the charge attempts the Fraud Dept. Rep told me that I couilldn't there were around 20 attempts to charge the debit card, that should caused a fraud alert and temporary suspension of the card. The only other card fraud I've had was 5 or 6 years ago on a Citi Best Buy MC and they made an automated telephone call to my mobile to verify the attempted 3rd fraudulent charge, which when I responded was not valid they shut the card down. And the only time I ever used the Penfed debit card was 5 Amazon 50+ cent gift card reloads to meet part of the $200 checking bonus. And Penfed doesn't let you deactivate/suspend the debit card online, which I always do on other banks when available.
How the heck do these fraudsters get your debit card#? Again the only time I used it was in June for Amazon gift card reloads, and I removed it from Amazon stored payment cards once the charges posted on Penfed.
Oh well, could have been much worse. I have a habit on checking on my all bank accounts once or twice a week, part of my morning routine while slugging down coffee. Hope your day goes better. 
Like you, I also use credit cards for everything. Because of that, I block/freeze all of my USAA (my main bank) checking account debit cards except for one. I carry that one unfrozen debit card with a penny loaded on it, and I transfer money on the fly (via app) if I ever need to pull out any cash. This rarely ever happens.
Does Penfed offer the ability to replicate what I do? If not, they would not be my main bank as of yesterday.
I just had my PenFed Gold card closed due to fraud and it is sitting in my safe.
PenFed actually notified me.
I will never have or use an ATM or debit card because of this.
Sorry you were hit with this OP, hopefully it all gets sorted quickly!
The Uber fraud is rampant, most likely those weren't actually people taking real rides. The scam uses fake accounts and fake rides, GPS spoofing is part of it, and stolen credit cards. Some of these are people trying to bilk Uber out of money, some are actually criminals who pay with stolen credit cards in an elborate scheme to launder money. These are called "ghost rides".
