That business is having enough problems without you dogpiling on.
Right off the bat, who do you think paid for that replacement credit card? Bingo. $50 per customer right there. Plus
- the initial cost of a PCI-DSS audit (even if they were innocent)
- huge fines if they weren't
- the actual cost of re-engineering their systems and procedures to be actually compliant
- get re-certified the hard way (since they are now untrusted).
- the cost of being unable to take credit cards while all this is sorted
- the cost of having any credit card revenue in the pipeline "on hold" until all fraudulent transactions are sorted
- oh yeah, and all the fraudulent transactions. So even if they're a hot dog vendor, they could be paying for a lot of leather coats and iPhones.
The simple fact is 80% of businesses in this situation go bankrupt at this point. You'll know who they are, when they fold up.
It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution. Often you see binary businesses like the baseball park and its contract vendor who runs all the concessions, where most poeple end up doing business with both. So they may not know, and telling you would be defamation.