Is the password on your Credit Card online account the same as any other account you use? Many people re-use passwords; that is, use the same password for multiple accounts. Never never never do that. If any one of those is compromised, they are all potentially compromised.
Also, ensure you have reputable malware prevention software (Antivirus, etc) on your device.
Malware can scan your computer for information, to include keyloggers, and report those back.
Use your router's software to ensure you are familiar with all the devices that connect to your network. A device sitting on your network can monitor traffic and report back.
The bottom line is there are several ways credit card information can be stolen. My understanding is that Roku doesn't store the data unencrypted. That is, a person can't read the data. It's much more likely that your network, your computer, or one of your online accounts sharing a password with your credit card company was compromised. That's not to say it couldn't happen, just not likely.
DBDukes
Roku Community Streaming Expert
Note: I am not a Roku employee.
If this post solves your problem please help others find this answer and click "Accept as Solution."