I found
https://upaycard.com/ which is actually a wallet which used to provide card before but I just register there few days ago and deposited 0.02BCH there (just $15). Sent a private message to their facebook page and asked them whether I can get a card right now or not and obvious reply was no not right now and we are searching for new card partner blah blah blah.
During my deposit, I also asked live customer support how much confirmation needed for my bitcoin cash deposit and they said 6 and I said thanks.
I left the site and BCH there, next day I got 3 messages in my gmail where hacker exchanged and withdraw out my BCH in BTC from the platform in a minute and they processed it instantly
So question here is, yes I have used long password but the only person who know that I have created account there is facebook admin of upaycard and live support staff. Also this occur just next day of my account creation. Is it from their customer support staff?
Upaycard is now asking my documents, I haven't sent any support ticket to them after this incident because I want to cover some truth about loyality of their customer support here.