Every documented case where credit card info was stolen from the web, including the story that broke on 2000/01/10, were shopping cart type systems using 40/128 bit security. In these cases, the data was stolen by hacking into the host site and accessing the data in the clear. In our case, the data remains encrypted until it gets to a computer with no web connection (or even a modem) for processing and record keeping.
In addition, having your credit card number stolen is a problem for merchants, not you or your credit card company. Your credit card company will refund any disputed charges, and then take the money from the merchant. It is up to the merchant to sue (if he can find) the fradulent user of the card number.