Could be Epic, could be privacy.com, or could be malware on your system. But every time I've tried alerting places they are leaking credit card #'s, I get the runaround or ignored. So I just assume it's on my end, take the necessary precautions, and let them figure out on their own if it's their problem.

Or a breach of privacy.com’s systems, lol.

I cant say for certain, but I do know that it's likely card number algorithms can be compromised in one way or another. I had a credit and debit compromised one day after another, the credit card having never been used at all. I had them both cancelled and reissued immediately, and after activating the new credit card it was done again the very next day. These were from the same bank, a small credit union based in Eastern Washington.

Again, it was cancelled, they told me it was an algorithmic attack, and the next card that arrived was activated and had no further issues despite use in person and online until it expired.

Maybe they were saving face after a breach, but that kind of attack felt far more likely given my lack of usage.

Depending on your country, maybe try contacting some sort of department that deals with consumer affairs?

Companies will rarely act on anything serious unless the government makes them.