Was tipped off and read the singletrack/bikeradar threads and got a bit spooked, cancelled my card, regretted the paranoia instantly and then a couple of days ago got an email from amazon confirming an order for a new TV to be paid for on my old card and delivered to a field in Kent so presumably they've made other attempts at stuff too (why on earth they'd register a new amazon account under my own email address (still use an old one for amazon) is beyond me...).
Get them cancelled before you have issues, it only takes a couple of days to get a new card through and it's better that way than risk being stung.
CRC phoned me up yesterday very apologetically, sounds like they've got no clue how it's all happening (my money's on rootkit). They're going to release a statement on their homepage in the next couple of days...