TD Bank Debit Card Compromised, Card Never Used!

[Anonymous]

I received a text today from TD Bank's fraud department that my debit card had been used for a suspicious purchase at AliExpress.com.  After checking my online account activity, it looks like the debit card number was also used for a smaller transaction of $2.97 which is currently pending.

The biggest problem I have with this is that I never used this debit card.  In fact, this card was issued to me in November of 2018 and immediately brought home and locked away.  It has never been used online, in-person, or at an ATM, but somehow the card number was obtained and used fraudulently today.

Is it possible for the card number to be guessed?  Otherwise, could TD Bank have had a breach causing the card number to be compromised?  

If anyone else had a similar issue recently please share!

[CreditCuriosity]

Yes it is possible to be guessed although pretty unlikely to get all the pieces needed unless there is some type of leak, but if you hit millions of cards you are bound to get some through automated programs.  Numbers of the card represent different aspects of a card such as a card starting out with 4 is a visa.  Various other digit represent other things such as bank etc..  and only 16 digits total.  Actually guessing a card number is more common than probably is known what also helps out is one must know the expiration date and CVV number and zipcode makes it more secure, but all that still can be obtained if someone is savoy enough or lucky enough and possibly gets some info from the banks db's, dumster diving for receipts/mail, and the list continues.