The key was the app’s, the data was the merchant’s, and the shopper had never heard of either. The party that knows how it was stolen has not spoken.