So far, we have no real evidence that this actually happened. How do we know that evilsock isn't an evil sock puppet out to damage Google's credibility?
And don't pull the old "an evil sock puppet would never use evil sock as their name". You probably believe the Google "Don't Be Evil" motto too, don't you?
Anyway, even if true, there's lots of ways to steal these card numbers, including simple guesswork. I've heard that in the case of store-bought gift cards, people will copy down a bunch of numbers, and then they'll keep trying the numbers until someone buys them and activates them. So maybe it's not Google Market that's compromised at all, maybe it's these Walmart credit cards.
tom
tom