It will be very unlikely that you will be able to sort out which retail outlet your card numbers were stolen from. Only basic requirements should be requested (name, contact points, interest level) with a Privacy Statement linked via the registration page clearly stating your marketing policy which by the way, you should adhere to without any deviation, or risk the wrath of your customers. It is not a very promising situation.