Re: OK, hands up ..
The main website uses tokenisation of Credit Card details.
If it wasn't then all customers details would have gone, this is most likely some 3rd party site which provides a service to EasyJet. Although it is still EasyJet who is responsible.