I got my credit card hacked the end of January. What a pain. I discovered and reported it within about 2 days. The bank said it could take a few weeks to get my refund, then after waiting over a month, they claimed that I had called in to cancel the claim, but couldn't give me any details on the supposed cancellation.
Unfortunately, I'll probably never know where the "leak" occurred.
Anyway, it seems to be one of those things that nobody seems to care enough to actually work on fixing the inherent security problems.
At least with PayPal, only one vendor gets your credit card/bank account info, and the rest just get the money transfer from PayPal.