Being as general as possible - refund policies are governed by bank and scheme policies, and so aren't necessarily the domain of law. There may be jurisdiction-specific regulations that limit your liability as a consumer, but there's not usually a legal requirement.
- You can report this to your local authorities, but without proof of a crime, it's unlikely to be actionable.
The website isn't necessarily to blame, either - if your computer or your connection to the website was somehow compromised, then your details may have been obtained in that way, and the website could have had nothing to do with it.
- Again, this is almost certainly wholly governed by their scheme agreement.¹
1. Some off-topic information here, which may or may not be accurate, and which you should not seek clarification for here (check Money SE instead, and first check whether it is on-topic there) - generally, bank policies will refund you for fraudulent transactions below a certain quantity or value. In this case, the bank tends to take a loss and chargeback rights are not exercised.
In other cases, the bank will require the merchant to prove that the authorised cardholder did in fact authorise the transaction. The level of proof is governed by the way in which the transaction was conducted and verified at the time of purchase - whether the CVV2 code was verified, whether address verification was completed, whether 3D verification was completed. If the merchant is unable to prove, according to the scheme guidelines, the transaction will be charged back to their account.