I think in the last two and a half years I have had a credit card hacked six times, not the same card mind, and so far the only impact was the lost time and the frustration while I changed cards and changed all my passwords. I also have a credit expert account that has warned me in the past that my personal data is doing the rounds in fraud circles, and that from someone who does not do Facebook or Twitter. Mind you on any social sites I often use fake details such as the wrong date of birth and so on so not much use when trying to do my credit cards. I also use my credit card on the Internet on an almost daily basis so I guess there is plenty of opportunity for my details to be collected.
I know a couple of my frauds were due Rendo but that was a long time ago and it was due to a 'third party' passing on details to the thieves and I only mention this for two reasons, firstly Rendo were honest enough to come clean and issue a public statement and secondly because no company can be totally immune from a dishonest member of staff. I think that is important because, just because your card in defrauded does not make the whole company rogue.
I do not use Paypal for the very reason they are not a bank and in the UK, I am not sure about other countries, there is some legal protection regarding banks and credit cards that would not apply to a Paypal transaction.
One of the biggest scams we have in the UK at the moment is a rogue company ringing up to say they are working for British Telecom (BT) and saying that they have noticed some errors on your broadband connection and if it is not sorted they will have to shut your broadband connection down. They 'help' by getting you to got to a site that allows them remote access to you computer then raid all your banking details and keep you on the line while a co-worker drains your bank and savings account. A few people have lost vast amounts on money although, in some cases, the bank has actually saved the day by noticing the strange transaction and declining.
Much as I dislike the practice, and hate the people that run theses scams, I have come to accept the fact that the possibility of online fraud is a price I have to pay for the ease of using the Internet and the low cost of most of my purchases. I do my best to avoid it by not using any site that looks dodgy, but that is a rare occurrence these days, using an password manager that generates complex passwords and reminds me to change them on a regular basis and also checking by cards on a very regular basis. I also have access to my credit record, which again I check on a regular basis so I can see when a search is done on my record or another card has been applied for. With all that I still have to accept I can do all I can to make fraud difficult but I am never going to completely rule out the danger.