The particular compromise attempt in South Africa was reported on lots of Internet forums.

My assumption is that Coinbase or their card provider was breached. That happens and I get it, but the lack of action (the card is still active!) in response to repeated customer inquiry is evidence of a broken process.