Ten credit cards from a retail store were found on the black market, all showing the same purchase point at that same retailer. The card brand alerted the store to the issue.
The discussed malware scrapes data out of memory and sends it to a central repository system. IP address tracking helps to determine which accounts the malware is owned by and what systems they are communicating with.