This right here is why I only use credit cards, I don't want to deal with money being tied up from my bank account, whereas I have multiple credit cards that I can easily use. Just about all credit card companies have zero fraud liability policies as well, which is good. There's a lot of ways your credit card info can be stolen: skimmers, breaches from the credit card side, breaches from vendors/merchants, etc. I wouldn't assume it was someone else on the boat or someone who works for RC, but it is possible, of course. The bulk of the time that I've had my cards compromised was when I was traveling abroad though, so if you used it in Haiti then that could also have been where the breach took place. As long as the charges aren't yours and your credit card company is taking care of it, I wouldn't worry too much. Most companies have good fraud teams and can trace the source, but it's nothing you'll need to deal with, luckily.
MDF: 2014, 2015, 2016, 2017
Summer Breeze: 2014, 2015
ProgPower: 2014, 2015, 2016, 2017, 2018