When the purchases are in a t-shirt shop in germany on minute and then in a grocery store in the US they are obviously constantly moving, so they are clever. They most likely sold that credit card data on in the millions and the people who bought that information are using the cards now.You can easily track where the purchases are coming from. So they aren't THAT clever.
To be fair I wouldn't trust Sony with any of my credit cards to be honest. I use a throwaway prepaid card for anything PSN purchasing and a strong no logging VPN just for the extra edge.The hackers are going to far now, hacking PSN, fair enough. Sony got what was coming to them, but using innocent peoples credit cards just to prove a point to Sony is a bit far.