anyone with knowledge of a user’s credit card number and expiry date to track all journeys made within the past seven days.

Honestly, if someone has your CC number and expiry date the last thing I would be worried about is them being able to see my history of subway trips.