No, you are probably right about this. It's doubtful it's paypal, and I doubt it's just one supplier. From what I've read, there's a lot of people being affected by this, so chances are it's a payment processor that's got a security issue. It's either that or a virus that's recording payment info.