All I know is, the card issuer knows who it was but will not tell us. The entire amount was removed from the account and we were issued another card wirth another number and another CVV.

I suspect it was someone connected with Google or the card issuer. Hence, the secrecy.