It's hard to say whether the problem originated from your end or Chesscafe's end. You might have malware on your system that allowed the theft of your information. However, the Chesscafe server does allow a weak cipher (RC4), which could have also been the reason for the info theft. Note that Chesscafe isn't alone; Some banks still allow the weak cipher. 
I'd recommend that you check out your system for malware, just to be on the safe side.
The last discussion of Chess Cafe (chesscafe.com) in the forums here was six months ago, so here is my recent experience. I had been out of the picture for a while and didn't realize until a couple weeks ago that it changed management, had stopped posting new content, and had put all its old content for the last 17 years behind a $25/year paywall.
However, I decided that the $25 might be a fair price considering how many pages of things are up their in their archives, so on Wed., March 18, I went online and paid by MasterCard. There is, as previously noted, a note saying that "you might not get sent your login information for three days", but I got my login information a couple hours later, and it seemingly works - all the old content is accessible.
So far so good, BUT the following also happened - I do not claim that this is related, but I think it's worth noting. On the afternoon of Thursday, March 19, I got a call from the fraud control unit of Citicorp. A whole pile of fraudulent credit card transactions had been made on my account that day, including a purchase on bookit.com, several payments to something called "CHECK MATE" (!) which is actually some service to get people's criminal records and other information, several payments to "IC Solutions" which apparently sells phone cards to call prison inmates, and a $50 payment to Domino's Pizza (gift card?). Fortunately the algorithms caught this stuff and it doesn't look like I will have to pay them, although my card has been canceled and I will have to move some of my autopays to another one, which is a minor pain.
All my transactions with this card in the previous week had been with merchants I do business with regularly, like my local grocery and the sandwich shop in my building. Is it a coincidence that these fraudulent bills hit the day after I gave chess.edu my credit card? Is it a coincidence that one of the recipients has a "chess related name" which someone might think a chessplayer would overlook on his statement? Maybe. I'm not saying "don't pay them any money". But I am saying maybe send it more securely than I did, and/or watch the account afterward like a hawk.