It's 100% a scam, just change cc details and ignore it, it will go away.

Also, it's a private company in another country, even if it were "legal" in any measure, that would only be in their country, and they'd have basically no means to do anything to you anyway.

Really man, just req a new card, and ignore them.