Hopefully, this is taken care of but you just CAN'T be too careful these days. I would have been concerned, too.
We recently had to have our bank ATM cards cancelled and reissued because someone got our numbers and made a purchase (thank goodness it was a small one) and we had to file a dispute at the bank and let them investigate it. It turned out this was a bogus company and the money was put back in our account. That's why I check my bank transactions online at least twice a week :)