Thanks for all the tips!
Here's where things stand now:
CU notified
Card canceled
Visa notified/report filed
LEO notified/report filed
Credit bureau's notified
Called "Danny" several times today already--left message....
FTC notified/report filed
As far as how it happened, I have no clue. Haven't been to NC, never heard of the listed company or "Danny." Usually don't use my debit card for anything online except for an occasional pizza order, etc. Just in case though, I cleared history/cookies and reset firewall/wireless security access.
I guess there is a slight possibility that this is an innocent mistake. I know it is possible, although highly unlikely, that a number was keyed wrong or written down wrong. Having been in retail, I know that getting one number off usually results in a bad card number not another account. Also, it was not multiple charges to test the water, just someone jumping off into the deep end with one big cannonball belly flop of a charge!