The only way I can think of how avast got the bank account/credit card number is that if a person had bought a paid product in the past or has used a trial of a paid product. It can be someone in the same household that did so.