I agree with the other posters. I use Paypal to pay for any upgrades on any site that I am not very familar with. More than likely your numbers were not stolen from this site but rather from some program running on your computer. I had a similar thing happen about 3 years ago. I was using Chase as my bank, I had been using another bank that was purchased by Chase. I kept getting emails from Chase, telling me that I had to update my account information within a certain time period to keep my account working properly. I never did it and saw an email one day and realized that I needed to update. Rather than logging in via the normal Chase method, I clicked the hyper link on the email ( a big no no ). It took me directly to the Chase log in but what I didn't know was that I was being shadowed by the sender of the email, they recorded every thing I entered. The next day I got an email from Chase saying that the following checks were pending for the next day, normally I don't even notice emails from banks since I get them all the time but fortunately I saw this one which had 11 checks scheduled to be delivered at various places in New York City, the checks ranged from $11,000 to $40,000 and would have cleared the account. Fortunately I called the fraud group at Chase and they cancelled all the transaction. Why they didn't wire the funds out I have no idea but I'm glad they didn't. Had to close this account and set up a new one, new checks and everything but no money lost.
If you had used a credit card, I think your liability is $50 but using a debit card online is very risky. I would never do that, hope you are able to recover your money.