UPDATE
I'm going to call the police dept. in their town and see about filing a report. Even if this transaction isn't enough for the police to pursue on its own they may have an ongoing case or be watching the house for some other reason, so maybe it'll help.
Thanks everyone!
I had a police officer tell me once that credit card fraud is a felony, and the amount being purchased with the card didn't matter. He used the example of someone going into a store and stealing a pack of gum. If you just steal the gum, it's a small misdemeanor. If you used a credit card fraudulently to purchase the same pack of gum, it would be a felony.
Yup. We were able to speak with someone at the credit union today and they said stealing credit info is a felony and a federal crime, no matter what. It's funny because my DH is a federal law enforcement officer so he's having a hard time not getting in the car and driving the two hours up to the address they attempted to ship to. Of course he won't, but he's fantasizing about how much fun he could have with it.

The credit union employee advised us that one of the largest identity theft rings in the country is based out of VA (where we are and where the shipping address they used is) so we are taking this very seriously. I just ran a credit check on myself and DH and put the 90-day security alerts on both our social security numbers, then I went to every website where we may have had credit card info stored and deleted it all (fortunately just a couple) and changed the passwords, finally I also changed the passwords to our online banking accounts. A real pain in the butt, but it could have been so much worse!
We heard from the lady at the toy store this morning and can you believe this (these?) idiot(s?) tried to use the card AGAIN? She also verified for us that they had to have not only DH's name and card number but his address and the security code off the back of the card to place the orders. I know if he used the card in person someone could have quickly written down his name, number and the security number before handing it back to him but I don't know if they would be able to obtain our address? That makes it look pretty good for being hacked online and there are only two places he had that info stored - amazon.com and the online services for consumer reports. Needless to say both of those accounts have been deleted and I'm going to contact their customer service departments and give them a heads up.
EDITED to add -
Toy store lady replied to my email and said the thief didn't try to use my card again today, they tried to use
someone else's card and reorder the same stuff and have it sent to the same shipping address they'd attempted to use with our card. She also advised us to call the police. This is nuts!