It could be an external breach as well. Think about it -- all someone really needs to make fraudulent expenditures through your cards is the number, your name, and the digits on the back.
Changing master keys is usually a good idea anyway. Be paranoid... a little. But if you're careful, the attack surface of corporate databases are far more plentiful than you alone.