Strong circumstantial evidence indicates my debit card has been compromised. The first clue was when I downloaded bank transactions to Moneydance, and there was a transaction purporting to be a debit to PayPal that didn't show up anywhere in my PayPal account.
It should go without saying that all appropriate steps have been taken.
Keep your eyes open, folks. Read your bank statements carefully and question any transactions you can't identify. There's a lot of thieves out there.